Keep Secret Keys Out
Store your local_settings.py data in a file encrypted with GPG - preferably as strictly key=value lines which you parse and assign to a dict (the other attractive approach would be to have it as executable python, but executable code in config files makes me shiver).
There's a python gpg module so that's not a problem. Get your keys from your keyring, and use the GPG keyring management tools so you don't have to keep typing in your keychain password. Make sure you are reading the data straight from the encrypted file, and not just creating a decrypted temporary file which you read in. That's a recipe for fail.
That's just an outline, you'll have to build it yourself.
This way the secret data remains solely in the process memory space, and not in a file or in environment variables.
Ideally, local_settings.py should not be checked in for production/deployed server. You can keep backup copy somewhere else, but not in source control.
local_settings.py can be checked in with development configuration just for convenience, so that each developer need to change it.
Does that solve your problem?
I doing my Django projects using Windows 7 and Powershell, so for me it was slightly different to set the environment variable. Once it was set though, I just did the following in my settings.py file:
import osSECRET_KEY = os.environ["SOME_SECRET_KEY"]To set a environment variable in Windows using PowerShell follow the instructions in the link below: