Why is more secure to store sensitive settings in instance settings instead config settings in Flask?
As @davidism suggested, Config files are never meant to be tracked since these are your secret keys and anybody with access to your code will have access to your keys if tracked.
But, there is no hard and fast rule in Flask to keep your settings file in a specific location. You can keep them anywhere and name them anything.
But, when adding the config to the app, the correct file path must be given.
I've read that it's best practice for security reason to store things like API keys in the instance/settings.py file in Flask - why is this so and what is the mechanism that makes it so. I haven't been able to find much documentation about this online.