`settings_local.js` doesn't get included in production. What's in `settings_local_hosted.js` is what gets put on -dev and prod. There's no secret config file somewhere.