I've made this mistake although fortunately with an unpublished app to a private repo but I'd still like to fix it.

My ideal solution will probably be to:

1) Look for an environment variable

2) Look for a file in the project config or root named: secret-git-ignore-this-file (or something similar)

3) If it fails to find either of then generate a new secret with secure_rand

4) If running on Heroku write it to the environment variable (I think this can be done and should persist although I'll need to check the documentation).

5) Otherwise write it to the secret-git-ignore-this-file

If/when I get round to this I'll probably try to put it on Github for others to use although if anyone knows of any good published solutions that do something like this that would be even better.