Keep Secret Keys Out
Here's one way to do it that is compatible with deployment on Heroku:

Create a gitignored file named .env containing:
export DJANGO_SECRET_KEY = 'replace-this-with-the-secret-key'
Then edit settings.py to remove the actual SECRET_KEY and add this instead:
SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
Then when you want to run the development server locally, use:
source .env
python manage.py runserver
When you finally deploy to Heroku, go to your app Settings tab and add DJANGO_SECRET_KEY to the Config Vars.
One of the causes of the local_settings.py anti-pattern is that putting SECRET_KEY, AWS
keys, etc.. values into settings files has problem:

Secrets often should be just that: secret! Keeping them in version control means
that everyone with repository access has access to them.

My question is how to keep all keys as secret?