then the code maintainers are doing it wrong.

Any information that shouldn’t be public knowledge such as specs, account credentials, access tokens etc should be in a configurable/dynamic format such as an ENV variable or a config file, that way confidential info isn’t part of the working tree.

This should not be an issue in a properly maintained codebase.