I like the solution I stole from rstat.us: you have an off-repository location for the token If there's none:

* on production you crash,

* on dev, you autogenerate one and save it to a config file that's possibly dev-only,

* during automated tests you just autogenerate something and live with it.

Here's the nice replacement for secret_token.rb: https://github.com/hotsh/rstat.us/blob/master/config/initial...