Oops, I replied to an out-of-context comment. I mean it's okay to use a wildcard policy in the early stage of a project.

Of course, committing credentials into a repo is absolutely never ever ok.