You might want to just switch to a dotenv library. Quick Google for Django yielded https://github.com/jpadilla/django-dotenv

Dotenv libraries are just for dev and other similar environments. In production you should still use normal environment variables (or whatever system you use to load your configuration), as dotenv files stay on the filesystem and sometimes even committed to your SCM.

haha this is like those domain name search websites that just automatically register the good sounding domain names for themselves once the user types it in.

do you OP! I think it still provides a service, enjoy all the secrets

If you upload secrets to public sites you're in trouble regardless of whether they claim "secure" hosting or not...

And what makes you think the operator has nefarious intent?