+ 2fa + sensible rotation of keys and passwords (especially if you use say github for personal / work / multiple clients) - they can have the password at that point and it is of limited use.