I wasn't so much worried about hiding password as about the fact that any configuration changes that I make get picked up as differences from the repo.  I'm not familiar with how Heroku works. What are their requirements?