That's an interesting issue (Django has the same issue with its SECRET_KEY). If you have an open-source project that utilizes these kinds of technologies, you need to keep your secret key secret.
As it says in the Django settings:
"Make this unique, and don't share it with anybody."
Incidentally, this is one reason why the 12-factor app methodology stores configuration in environment variables, not source files. http://www.12factor.net/config
As it says in the Django settings:
"Make this unique, and don't share it with anybody."
Your web application's security depends on it!