The keys themselves should not be in the source code. The source code for this project is available to anyone, and therefore they will now have your stripe secret key. 

Consider:

* Adding the https://github.com/bkeepers/dotenv gem to the project
* Adding a .env file to your Rails app's root folder (see README)
* Adding the .env to .gitignore
* Modifying the README to indicate that you need to set 2 ENV variables from which the Stripe keysa are loaded