I got a .net framework solution that has secret settings (API keys, connectionstrings etc) in a web.config. The solution code lives at github.com. I want to avoid having those secret settings at github at all. I got a teamcity build server, that has those settings and merges them into the web.config at build time for the different enviroments, just before deploy time. This works great. But I need ideas of how to handle those settings for developing locally, where the teamcity server (of course) does not build and merges settings.
Could it maybe be possible to inject some code i global.asax on Application_Start, to fetch the settings from a secure place and set the settings there? Or maybe have a different config file just for development that is only loaded when developing and is not committed in github? Or is there some other smart way that I can't think of?