This is true with encrypted credentials, if security is compromised by release of the repo then the encryption is not secure. I think the spirit of the principl

This is true with encrypted credentials, if security is compromised by release of the repo then the encryption is not secure. I think the spirit of the principle is met, and in cases where you do later release the source code without having planned for it, it's easy enough to move the secrets. It's definitely more convenient to use the same repo, especially in the declarative containerized world; you can make sweeping changes or roll them back in a single atomic commit. That said, if open source is the intent, certainly use multiple repos from the beginning so you avoid git gardening when releasing later.