People never remember to change this, including us, and since the repo is public it's a security hole.  Here's a good fix: https://github.com/smartchicago/chicago-early-learning/blob/master-v1/install.sh#L188 .  The only problem with it is if we run it every time we provision it will regenerate the secret key which I believe invalidates the CSRF tokens which may break the site.  It might be advisable to split some things like this out into a one-time setup script that's separate from the one that runs when provisioning.