Should the signing salt be secret, too?

[kylekthompson]

This is less of an issue and more of a question.

Session cookies are signed with both the signing_salt and the secret_key_base. Is there a reason for not defaulting to keeping the signing_salt secret and different from dev/test (similar to how the prod_secret_key_base is generated for prod.secret.exs)?

If not, I am more than willing to open a PR for my first contribution!

[josevalim]

The secret_key_base is enough as a secret. There are also advantages for keeping them in different places.