Yeah, this drives me up a wall. I have a coworker who constantly champions the bull* static code analyzer we use catching "security" issues...and then sends around certs and keys via Slack and email. :/