If you use a branch named heroku as your "alternative master" branch (with sensitive data) and your old master branch without the sensitive data, then you could always do
git merge master
So you can push heroku branch to heroku not the master branch.