Hacker News Reader

Things that might be hardcoded are access keys and passwords to PII databases.

Which is bad practice for lots of reasons and, is that a HIPAA violation? Your code also has it then.

Hosting git externally might be an issue though.

No. No no no no no.