title: Is it okay that database credentials are stored in plain text?
body: <p>By default, the Django database host/user/password are stored in the project settings.py file in plain text.</p>
  
  <p>I can't seem to think of a better way at the moment, but this seems to be against best practices for password storage. Granted, if an attacker has access to the settings file, then all is probably already lost. Even if the the file were encrypted, the attacker would probably have the means to decrypt it by then.</p>
  
  <p>Is this okay?</p>