title: Hide credentials in a public repo, which is being used to deploy live
body: <p>What are best practices in hiding credentials, such as API keys or database credentials, in a public repo such as GitHub? My go-to solution is to have a config file which stores the credentials, then add a gitignore file to not include the config file during push.</p>
  <p>The caveat is this repo is being used to deploy with every push, e.g. Netlify or Heroku. So a Netlify / Heroku website is online from the repo push. In this case, if there is an API call or database request, the credentials would need to be in the public repo, as this is the &quot;production folder&quot;.</p>
  <p>I've heard of Travis CI, and that it could build after a GitHub push, but I have not looked into it much. How do other projects use their credentials when deploying from a public repository?</p>