Oh you're absolutely right, but there are some fairly straightforward steps to take to mitigate the risk with little effort. You can take arguments or env vars

Oh you're absolutely right, but there are some fairly straightforward steps to take to mitigate the risk with little effort. You can take arguments or env vars or config files (not added to Git) for your secrets. If you begin with a system of not putting the secrets in the code, ever, it's fairly straightforward to not make this mistake. A few minutes of setup on a repository and a mindfulness to be sure not to commit any new secret files that may be in use (and add them to the .gitignore) is a great start before getting to secret management a la Vault.