When using the vcr gem to mock HTTP responses, you need to add lines like this to make sure your secrets don't get into your cassette files:
VCR.configure do |c|
# ...
c.filter_sensitive_data('<GITHUB_APP_ID>') { ENV['GITHUB_APP_ID'] }
c.filter_sensitive_data('<GITHUB_APP_SECRET>') { ENV['GITHUB_APP_SECRET'] }
end
It would be nice if secretive offered an integration that would automatically tell vcr to filter everything in secrets.yml.
I'll work on this when I have time.