Where should we put environment variables that both work on local host and deployed online yet make sure the credentials are safe?
Check this: http://guide.meteor.com/security.html#api-keys
Depends on your deployment, tbh. Modulus has a little section where you can add environment vars
Not every hosting provider uses Meteor.settings, however.
For those circumstances where Env variables need to be used, we put together a meta-package that includes most all the functionality from the other packages on Atmosphere that involve env variables