The secret token is not supposed to be in a rails app public repo - and anyone that has it pushed to a server is potentially vulnerable to having their server owned. See: (How to hack a Rails app using its secret_token)[http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/]