It's been my impression that the standard (promoted by services like Heroku and Travis) is to pass secrets as environment variables.