If you're planning to work with minimally-vetted freelancers or otherwise need to consider malicious internal stuff, strongly consider injecting sensitive data

If you're planning to work with minimally-vetted freelancers or otherwise need to consider malicious internal stuff, strongly consider injecting sensitive data like database passwords via e.g. environment variables instead of storing them in the repository at all. Rails etc. should make this easy. (Of course, your system administrator can still read that data, but that's pretty much unavoidable.) (This is a best - and common - practice for exactly the reasons you hint at.)