I was about to say "who in their right mind stores PW info in github?" before I realized I've worked several projects that do just that. Crazy decisions, but at least as a small mitigation, all that PW data needs access to a VPC to be useful, and that access isn't part of GitHub. Still not good practice by any means.

Having come up working on classified systems, it pains me greatly to see such lax security.