The real solution to this problem is to reference passwords, tokens, keys, or and other "private" strings with environmental variables or external config files,

The real solution to this problem is to reference passwords, tokens, keys, or and other "private" strings with environmental variables or external config files, which are then excluded from the source control system. That way your super-secret stuff can never be extracted from git or svn. This approach also has a whole class of additional benefits relating to being able to run a system in different places (for example- setting up dev->test->prod staging servers)