the fixing of the problem is easy , use freaking envirronment variables ! there is not one language/framework whatever that doesnt support them , so for exemple

the fixing of the problem is easy , use freaking envirronment variables ! there is not one language/framework whatever that doesnt support them , so for exemple in node : > var db_password = process.env.DB_PASS ; You dont have to keep any password sensitive file whatever inside an opensource project. that is what envirronment variables are fucking made for !