Is there a recognized practice for keeping security details in files excluded from version control?
We split our settings.php file into two separate files:


settings.php (for configuration that applies to all environments)
local-settings.php (for configuration that applies specifically to the current environment)


"settings.php" is stored in version control, while "local-settings.php" is excluded. Each environment has its own version of local-settings.php, which contains its database credentials and other configuration that applies only to that environment.

At the bottom of settings.php, we include the local-settings.php file.

/**
 * Check for a local-settings.php in this direcory. Include it if one exists.
 */
if (file_exists(dirname(__FILE__) . '/local-settings.php')) {
    include dirname(__FILE__) . '/local-settings.php';
}