Add security best practices

[RobertLowe]

This is entirely weak: https://react-tutorial.meteor.com/simple-todos/12-deploying.html#12-3-Set-up-settings

Sensitive credentials should not be stored in git.

[filipenevola]

Thank you @RobertLowe