I think config.yaml should be checked in by default, as services like Heroku would require this. Password can be hidden by using the erb trick specified in the config file.