I think that works fine for everything except SECRET_KEY where it's too easy to fuck up and have a non-secret secret key. I think in this case it shouldn't be anywhere and the software should barf and tell you you're missing your SECRET_KEY when trying to use it without one.