You really cant fix stupid. There are only 88 instances on github and they also include server passwords and usernames which is far more serious for them than the secret.

Some people deserve to be hacked

regardless of the actual number or the stupidness of people... not providing defaults for otherwise secure credentials is security 101.

I have tested this item ✅ successfully on 141ea36

The secret is generated on install, so IMHO the default can be removed.

I have tested this item ✅ successfully on 141ea36

RTC

So what happens if a user uses this file and forgots to add a secret? Does any place in Joomla! crashes, because there is no secret?

Additional probably we should extend the comment to help the user to define a secret (16 characters, uppercase, lowercase alphanumeric, ...)

So what happens if a user uses this file and forgots to add a secret? Does any place in Joomla! crashes, because there is no secret?

Joomla runs as normal. Joomla does not validate the secret, and does not care that there is not one defined.

Additional probably we should extend the comment to help the user to define a secret (16 characters, uppercase, lowercase alphanumeric, ...)

No we absolutely should not. This goes against all security best practice in 2021, the same way it is now around upon to provide and enforce password policies other than length. As Joomla can accept a empty string as a secret (rightly or wrongly) any artificial complexity rules are simply wrong.

Thanks!