Look into ".gitignore", also consider manually adding the files you've worked on and wish to commit.

Yes people think I’m insane when I manually add files to a commit. -a is another foot gun.

That's sort of what I wrote.

I just make sure to have a single location for sensitive stuff, then ignore/move it.

I will store the contents of the file as an encrypted note in 1Password, so I do have a stored version controlled variant.

What is interesting here though that this, like the Covid-19 leak in Brazil, the leak was on an employees GitHub. Not a companies account. So sure the employee could have prevented it, but from a company perspective. They have no authority to enforce coding practices on a personal GitHub account. The only thing I can see preventing this at an organisational level is a DLP solution scanning the repositories (GitGuardian does this for example)

Not if you use TruffleHog and GitGuardian.

Those are "close the barn door after the horses have run away" solutions.

The best solution is to plan ahead.

You can put detection in the CI/CD pipeline to prevent from getting into the repository. And in any case. Knowing the horses have run away as soon as possible is pretty essential in damage prevention. What is interesting for me here is that this leak, like the Brazilian covid leak, happened because of an employees GitHub repository. Which companies have no authority over. GitGuardian at least scans the GitHub accounts of employees though.

True, but I have always taken the position that security starts before we write our first line of code, and should be something that we keep front and center, every line we write.

When I write a line of code, I have an automatic "red team" approach. I think "I'm a blackhat hacker. How do I leverage this line?"

Not a 100% guarantee, but it sure does help the result to be more secure.

In my experience, 99% of security is good old-fashioned horse sense.