How to store database credentials for an open-source Heroku Node.js app?

Question

I am building a Node.js application and need to store database credentials (and other runtime properties) in such a way that they can be read when deployed on Heroku. My source is available in a public GitHub repository.

I am currently using environment variables, configured using heroku config:add, but am looking to understand if there are any alternatives. I would potentially like to use Cloud9 IDE, but it does not currently support environment variables.

Another option is to store the parameters in a config. file, but I believe the file would need to be checked in to Git (and as such, be publicly available) in order to be pushed to Heroku.

Thanks for your help.

Answer 1

ENV vars are generally considered the way to go, and the way Heroku do it themselves for database_urls and the like.

As you and your app are the only people with access to the env vars, you're generally OK security wise.

Putting credentials in Git or similar is a bad idea as it's another place that needs to be secured.