The JSS team have an answer [here][1] which outlines how to use environment variable and a .env file to move JSS config out of code.

  [1]: https://github.com/Sitecore/jss/issues/416