I'd be tempted to add empty string here as one of the disallowed values; it might be pretty easy, for example, to try to set your secret with an environment variable and end up with it empty due to a typo.

It could also be possible to check `secret.length > TOO_SHORT` but maybe that's overboard. Harder to imagine how someone would set a short secret accidentally.