On: 1% of CMS-Powered Sites Expose Their Database Pass...

[kmfrk]

    The best way to do configuration is to have it in
    environment variables

Isn't it the only sensible way, actually?

Django doesn't expose static files the same way, so you still get away with a secret.txt stored as a file.