one good idea I had was using a patch queue to insert database and other "secret" settings into a Mercurial pull.

So when I deploy updates to sites we pull and update the changes then merge a locally stored patch queue to reconfigure the settings.

Because the settings are locally stored on the server (not in the site root) there is no way for people to steal the details from the public mercurial server :D