Securing the Secrets File

Some developers take steps to prevent the config/secrets.yml file from
being checked into Git. To prevent the file from being saved to your
repo you could add the filename to the .gitignore file in your
application root directory.

If you’ve used Unix environment variables in the config/secrets.yml
file, there’s no reason to add the file to .gitignore. If you only
reveal the SECRET_KEY_BASE used for development or testing, and no one
can access your development machine, no useful secrets will be revealed
in your GitHub repo.

When you deploy to Heroku, the config/secrets.yml file must be in your
Git repository. For that reason, I suggest you save the file in your Git
repo and keep your secrets safe by using environment variables.