kevinmarks/noterlive — pull request #5 by bcomnes (2014-09-21 22:18:10+00:00)
Title: Removed secrete keys from web.js

Per the recommendation on the twitter apps key interface: "Keep the "API secret" a secret. This key should never be human-readable in your application."

Maybe you already do something different, but its generally a bad idea to keep API keys in your source code. Set those secret vars as ENV vars instead in your heroku or hosting environment.

Also probably regenerate your keys, although I could be mistaken.