rails Application 2-Step Authentication

I recently started studying rails.

I have heard a long time ago that there is a security problem when I post an application made with rails on github, so I would like to ask you a question.

According to the investigation, we found a pattern to put in a two-step authentication gem and a pattern to be set up on Google, and now we're going to set up a two-step authentication on Google and generate a new password on Google. In the code of the application, I rewritten it to :password in config.action_mailer.smtp_settings in development.rb.The mail function itself works fine, but is there no security problem with this?

By the way, the rails app was created with the assumption of ec site, and we use confirmation emails when confirming orders and shipping items, as well as email when registering and changing users.

That's all.I would appreciate it if you could let me know if there are any other problems that need to be set up.Thank you for your cooperation.