diff --git a/.gitignore b/.gitignore
index f2d50778..7e0c1e9d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,6 @@ _ReSharper*/
 **/packages/*
 *.nuget.props
 *.nuget.targets
+
+# sensitive files
+appsettings.Development.json
diff --git a/src/SMAPI.Web/Framework/LogParser/PastebinClient.cs b/src/SMAPI.Web/Framework/LogParser/PastebinClient.cs
index 8536f249..e45a9eed 100644
--- a/src/SMAPI.Web/Framework/LogParser/PastebinClient.cs
+++ b/src/SMAPI.Web/Framework/LogParser/PastebinClient.cs
@@ -75,7 +75,7 @@ namespace StardewModdingAPI.Web.Framework.LogParser
                         .PostAsync("api/api_post.php")
                         .WithBodyContent(new FormUrlEncodedContent(new Dictionary<string, string>
                         {
-                            ["api_dev_key"] = "b8219d942109d1e60ebb14fbb45f06f9",
+                            ["api_dev_key"] = this.DevKey,
                             ["api_option"] = "paste",
                             ["api_paste_private"] = "1",
                             ["api_paste_code"] = content,
diff --git a/src/SMAPI.Web/appsettings.Development.json b/src/SMAPI.Web/appsettings.Development.json
index e49eabb7..1080ee00 100644
--- a/src/SMAPI.Web/appsettings.Development.json
+++ b/src/SMAPI.Web/appsettings.Development.json
@@ -1,3 +1,12 @@
+/*
+
+
+  This file is committed to source control with the default settings, but added to .gitignore to
+  avoid accidentally committing login details.
+
+
+
+*/
 {
   "Logging": {
     "IncludeScopes": false,
@@ -7,7 +16,12 @@
       "Microsoft": "Information"
     }
   },
+  "ModUpdateCheck": {
+    "GitHubUsername": null,
+    "GitHubPassword": null
+  },
   "LogParser": {
-    "SectionUrl": "http://localhost:59482/log/"
+    "SectionUrl": "http://localhost:59482/log/",
+    "PastebinDevKey": null
   }
 }
diff --git a/src/SMAPI.Web/appsettings.json b/src/SMAPI.Web/appsettings.json
index f99748d6..397765eb 100644
--- a/src/SMAPI.Web/appsettings.json
+++ b/src/SMAPI.Web/appsettings.json
@@ -1,3 +1,11 @@
+/*
+
+
+  This contains the default settings for the web app. Login credentials and contextual settings are
+  configured via appsettings.Development.json locally, or environment properties in AWS.
+
+
+*/
 {
   "Logging": {
     "IncludeScopes": false,
@@ -19,8 +27,8 @@
     "GitHubBaseUrl": "https://api.github.com",
     "GitHubReleaseUrlFormat": "repos/{0}/releases/latest",
     "GitHubAcceptHeader": "application/vnd.github.v3+json",
-    "GitHubUsername": null, /* set via environment properties */
-    "GitHubPassword": null, /* set via environment properties */
+    "GitHubUsername": null, // see top note
+    "GitHubPassword": null, // see top note
 
     "NexusKey": "Nexus",
     "NexusUserAgent": "Nexus Client v0.63.15",
@@ -28,9 +36,9 @@
     "NexusModUrlFormat": "mods/{0}"
   },
   "LogParser": {
-    "SectionUrl": null, /* set via environment properties */
+    "SectionUrl": null, // see top note
     "PastebinBaseUrl": "https://pastebin.com/",
     "PastebinUserAgent": "SMAPI/{0} (+https://github.com/Pathoschild/SMAPI)",
-    "PastebinDevKey": "b8219d942109d1e60ebb14fbb45f06f9"
+    "PastebinDevKey": null // see top note
   }
 }