Exposing all ```settings`` seems dangerous. Aren't there db connection details and credentials in there?