oh right. that makes a lot of sense. you dont know what something does and you tested a fraction of joomla's capabilities and conclude that there is no need for it at all and it should be deleted. Get a grip. Do you really think it is there for no purpose at all. Surely everyone knows by now that it is used to provide secure remote access to any joomla web site when providing technical support.

Since you are using my name (and my comment software, apparently) on this site I felt obliged to enlighten you on what the $secret is used for and why what you did, even though it doesn't visibly break anything, has screwed up your site's security.

The $secret value is used as an encryption key, typically using the Joomla\CMS\Crypt\Crypt class — which in turns extends from the Joomla Framework Joomla\Crypt\Crypt class.

So, where is it used in the Joomla core itself? I will give you some of the spots it's used, you can find the rest by grepping the codebase for ->get('secret'

• Encrypting the Two Factor Authentication configuration. This means that even if your site has a SQL injection vulnerability which allows exfiltration (but not modification) of arbitrary table data the attacker would not be able to circumvent Two Factor Authentication. See \Joomla\Component\Users\Administrator\Model\UserModel::getOtpConfigEncryptionKey
• It is used in \Joomla\CMS\Version::generateMediaVersion to create a media version key. Why not just use an MD5 of the CMS version? Because without the secret as a salt it makes fingerprinting your site dead easy, something I have explained ELEVEN YEARS AGO in the Joomla Community Magazine.
• It is used in \Joomla\CMS\Application\ApplicationHelper::getHash to generate secure hashes — we'll get back to that later.
• It is used in various places, e.g \Joomla\CMS\Application\SiteApplication::initialiseApp, to handle cookies with secure names. It's a subcase of secure hashing as above. We'll get back to that later.
• It is used for the API application's token authentication in \PlgApiAuthenticationToken. By removing the secret you are degrading the security of the token authentication from virtually impossible to break to trivially breakable.
• It is used by the WebAuthn plugin to create secure user IDs. Another case of secure hashing. See \Joomla\Plugin\System\Webauthn\CredentialRepository::getEncryptionKey

It is already quite obvious that using an empty secret has so far broken the security of your site. And this is not even half as bad as it really is once we talk about secure hashing.

Joomla uses MD5 or SHA1 sums of otherwise easily guessable information to create cookie names and single use tokens. For example, the session cookie name, the Remember Me secure tokens etc need a fully random and long enough $secret to be truly random; if they are not, their names can be guessed which means that an attacker can fairly easily impersonate you or any other user on your site. At a minimum, they would be able to issue a password reset and try one of the few hundred reset tokens possible for the timespan between sending the request and receiving a reply. With a truly random, long secret word this is no longer a few hundred possible tokens, it's several billions of them making it practically impossible to abuse the password reset feature.

This becomes even worse when you take into consideration that third party applications also use \Joomla\CMS\Application\ApplicationHelper::getHash or the $secret to create secure hashes. For example, since you are using Akeeba Engage for your comments, remember that all admin URLs are signed so you can take action without being logged in. Well, well, well, how is this done? Right, by using the $secret:

public static function getToken(string $task, string $email, string $asset_id, int $expires): string
{
   $signString = $task . '-' . $email . '-' . $asset_id . '-' . $expires;
   $key        = Factory::getApplication()->get('secret');

   return hash_hmac('sha1', $signString, $key, false);
}

So what does that mean? The signature requires me to know $task (that's the action I am taking), the $email (your email is not a secret!), the $asset_id (I can try using values 0 to 1000 and I'm in) and an arbitrary expiration date which is under my control. Since I know your $key to be an empty string I can now issue 1 to 1000 HTTP requests and publish / unpublish / delete any comment on your site. All your comments are belong to us. Just because you idiotically removed your site's $secret. For the love of $deity, don't do that!

If you are using LoginGuard for Two Factor Authentication, same deal, we use $secret to protect the configuration. If I can get a dump of #__loginguard_tfa and know that you're using an empty key I can decrypt it in a split second and pwn your sorry butt.

NEVER, EVER USE AN EMPTY, NON-RANDOM OR SHORT $secret ON YOUR JOOMLA SITE. THIS LITTLE STRING IS A MAJOR FACTOR TO YOUR SITE'S SECURITY.

Now that you done f****d up, Mike, please go to https://www.random.org/passwords/?num=3&len=24&format=html&rnd=new concatenate the three passwords into one big 64 character password and put it into your site's $secret before someone far less kind than me decides to teach you a lesson by hacking you instead of educating you. I can't believe that you not only emptied your secret but proudly told the world you did... This is exactly just as stupid as telling the world that your front door no longer has a key! I'm shaking my head in disbelief...