One of the most well-know Symfony configuration options is the secret,
which can be configured via the framework.secret option or the APP_SECRET
env var in one of the .env files processed by Symfony. Regardless of how you
configure it, this value ultimately becomes the kernel.secret parameter in
your application.

Despite its name, this option is not needed at all in new Symfony applications.
It is only relevant for optional features that you might never use, such as:

Login links for password-less logins;
Remember Me for automatic logins based on prior sessions;
Rate Limiter for controlling the frequency of specific actions;
ESI for content includes when using HTTP caching.

A long-term effort in the Symfony project was to allow creating new applications
without requiring a secret value. In Symfony 7.2, we finally achieved that goal,
so new applications now come with an empty secret by default.

To accomplish this, we did the following changes:

PR #56840: Updated the login links feature to allow defining a custom secret
value for signing the links. It now relies on kernel.secret by default,
but no longer requiring it;
PR #56838: Deprecated the $secret argument in Remember Me feature, as
this secret has not been used since the feature was refactored to the new
authentication system;
PR #56831: Removed the use of the secret in the Rate Limiter for hashing IP
addresses and usernames, which is done to anonymize data;
PR #57462: Modified secret resolution in configuration files to happen
lazily, avoiding issues during file processing;
PR #56985: If you use secrets to store sensitive information, you must
configure a decryption key. In Symfony 7.2, this key will also serve as the
kernel.secret when a secret is required but not defined.

With these changes, if you enable a feature that requires a secret but have not
configured one, Symfony will throw an exception with a clear message explaining
how to resolve the issue.

Finally, to improve DX (developer experience) during local development, Symfony
automatically generates a secret value for the local environment when creating a
new application. This value is stored in the .env.dev file, which is a safer
practice compared to the previous approach. Previously, the secret was generated
in the main .env, which is also used in production and could potentially be
exploited by malicious actors within the development team.

Symfony Blog

Read More