The difference here is GitHub doesn't auto-upload Python files without me knowing. If I open my secrets.py file I know it's not getting uploaded to GitHub because I see it's absent from the staged files.

I don't think Kite prompts you before uploading every time you open a file.