A recent shared secret, I defaulted to "not very secure" for local dev/testing, but uses an environment variable in practice.