Store credentials in Heroku environment variables instead of wp-config.php. Credentials should never be stored in code.
Merge branch 'store-keys-and-salts-in-env' of https://github.com/thecurator/wordpress-heroku into thecurator-store-keys-and-salts-in-env