title: How do you keep secrets.yml secret in rails?
body: <p>I'm pretty new to rails, but I have some experience programming in PHP and other languages.  I really like rails, and I'm working on an application for my company, but I still don't fully understand how the secrets.yml file works with git and heroku.  I understand that secrets are used for authentication, but I don't understand exactly how to keep them secret while still deploying to heroku through git.</p>
  
  <p>First question is, do I really need to keep my development and test secrets a secret?  Rails automatically sets production development secret to the environment secret (which I still don't fully understand), but why would it matter if people knew what my development and test secrets are?</p>
  
  <p>Secondly, what is a good resource to better understand using secrets.yml file in conjunction with git?  The rails guide doesn't seem to document using it very well (only about a paragraph is dedicated to secrets.yml), and this seems like a pretty important topic that could lead to a serious security flaw in your application.</p>
  
  <p>Finally, how do other people protect their secrets?  Looking at several example apps on github, I've noticed that most people don't seem to take any steps to keep the secrets file in .gitignore.  Is this simply an oversight, or is it because it isn't as serious of a security matter as I think it is?</p>
  
  <p>I appreciate any help I can get.  I've been researching this particular issue for a while and haven't really gotten any comprehensive solutions to the problem.  I want to present my project to my company and explain the advantages of using version control systems like git, but I also want the app to be secure enough to trust that it is keeping my company's data safe.</p>