Hi Sam, sorry for the late reply. I didn’t received any notification about these issues.
We don’t consider setting configs via WordPress admin because they will be saved inside the DB and we want to avoid this (as much as possible). It makes really hard working with different configurations for different environments (e.g. local, staging, production) or different developers. It’s better having app’s configurations inside a configuration file.
I understand your concerns about open source projects. In these cases, Twitter keys could be moved in an external configuration file and loaded inside the code. Such file should then be ignored from VCS, e.g. placed inside .gitignore using Git. Each developer working on the code will have its own configuration file.
A basic example could be to use some custom define(...) inside wp-config.php, then place the wp-config.php in the .gitignore.
It’s worth mentioning Bedrock that is a great boilerplate for a modern approach for developing with WordPress. It supports out-of-the-box configuration files.
