I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings.php in the .gitignore because it contains sensitive database info, namely as login credentials.
My local database is open to anyone, so the commented-out privileges portion in the default settings.php file doesn't seem to matter now. However, the database on the live server will have a proper username/password combo. To my (limited) knowledge, it sounds like I'll have to put these in setting.php in order for my site to be able to log in.
My question is: Why is it safe to put these credentials in the public www folder under /sites/default/settings.php but not put them in Git? Is that not safe either? What's the proper, secure way to give my site access to my database?