Regarding PII, I think you have a very good point. I wouldn't be surprised to see working AWS_SECRET_KEY values appear in there. Indeed, given that copypaste programmers may not understand the code they're given, it's entirely possible that someone may run code which uses remote resources without the programmer even realising it.