PHP application configuration
I'm wondering if settings.php is in the same directory tree where you have other scripts like index.php served by the web server.
I don't know if this is possible on Heroku,
but I recommend to move files that should never be served by the web server outside of the document root.

One time, I had a web server malfunction: the well-tuned configuration file got replaced with something primitive, and php disabled, where visiting settings.php in a browser would simply display the contents of the file without running through the PHP interpreter. Sure, this seems unlikely to happen, but by moving sensitive files outside the document root, you can effectively safeguard against such or similar misconfiguration issues. I also find it good organization to separate public files from internal details. So my PHP projects all have a public/ directory inside, containing practically views only, the model is elsewhere, cleanly separated.

About this:


define('DB_URL', 'mysql://root:password@localhost:3306/database');



Even if it's a dedicated and isolated database for your project only,
I don't see why would you ever use the root account.
Create a dedicated user with carefully selected grants instead.

Needless to say, settings.php should have restrictive permissions in the filesystem.