You've likely found a good solution by now, but just in case, I'd recommend you utilizing Heroku's environment configs.
In your cloudinary.yml use environment variables:
production:
cloud_name: sam-thornton
api_key: <%= ENV["CLOUDINARY_API_KEY"] %>
api_secret: <%= ENV["CLOUDINARY_API_SECRET"] %>
enhance_image_tag: true
static_image_support: true
And then set your Heroku config from a terminal:
heroku config:set CLOUDINARY_API_KEY=YOUR_KEY
heroku config:set CLOUDINARY_API_SECRET=YOUR_SECRET
This way you can safely keep your cloudinary.yml file in a public repository (and therefore will still be able to sync it with Heroku) without having to release sensitive information.