Security Key and Boilerplate
You can run the craft setup/security-key console command after cloning the repo.  That'll generate a security key for that Craft install and put it in the local .env file.

Or for that matter, craft setup will run the whole setup process (database credeitials, security key, etc.).


  Are there other security considerations to take into account?


Keep your craft/config/license.key out of the repo so that a new one is generated for each cloned site.