Add a config.json file

Which can be overwritten in production with all the secrets.