I have a python/flask app and I use heroku to host it.
I use some additional services, such as stripe, postgresql or emails.
All these services have either secret keys or other access data, which must be kept secure.
I keep all this data in a config file, my config.py.
If I push the files to heroku, the config file is also pushed into heroku's github repository. So the information is on heroku anyway.
Recently I found out for postgreSQL that it is much better to save the DB URL in the heroku app, in an environment variable. (I use the postgreSQL add-on and heroku sometimes does maintance and changes the URL. By saving the DB URL in heroku my app does not crash, because heroku cant edit the config file, but it can change the environ variable to the new DB URL).
So instead of having the DB URL exposed in the config file:
DB_URI = 'postgres://fwewerwfwer:firstname.lastname@example.org:5432/d7bbwfwdbuwer'
It would be saved in heroku and the config file would look like this:
DB_URI = os.environ['DATABASE_URL']
So I am thinking wouldn't it be better to follow this practice for all my sensible access data?