Probably not a good idea to keep your profiler open to the world as long as you allow reading from arbitrary files. After a bit of fiddling around I was able to read your secret key from the settings file. It starts with 'es!b3'. And your soundcloud password. Sorry.
This is just plain wrong. There is no reason not to use setup.py for your private "application" as he calls it. Even if it's not distributed trough the public index you may still benefit from having version numbers and "abstract" dependencies for your app. That way you may choose where to look for the dependencies at deploy time and use a private cheeseshop for delivering your private packages, not to mention that requirements.txt is a pip only thing.