rails/rails — pull request #14654 by Alamoz (2014-04-09 01:04:21+00:00)
Title: Expand explanation of how to set secrets.yml.

The guide for upgrading to Rails 4.1.0 suggests copying the existing secret_key_base from the secret_token.rb initializer to secrets.yml under the production section. This is considered insecure by default in Rails 4.1.0, which generates a secrets.yml containing <%= ENV["SECRET_KEY_BASE"] %> for production mode:

production:
secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

So this expanded explanation offers users both methods.