One of the causes of the local_settings.py anti-pattern is that putting SECRET_KEY, AWS
keys, etc.. values into settings files has problem:

Secrets often should be just that: secret! Keeping them in version control means
that everyone with repository access has access to them.

My question is how to keep all keys as secret?
Here's one way to do it that is compatible with deployment on Heroku:

Create a gitignored file named .env containing:
export DJANGO_SECRET_KEY = 'replace-this-with-the-secret-key'
Then edit settings.py to remove the actual SECRET_KEY and add this instead:
SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
Then when you want to run the development server locally, use:
source .env
python manage.py runserver
When you finally deploy to Heroku, go to your app Settings tab and add DJANGO_SECRET_KEY to the Config Vars.
Keep Secret Keys Out