I'm not sure there's a "best way" aside from being vigilant. * Don't blindly add everything to git. * Check staged files before commit. * Store secrets separ

I'm not sure there's a "best way" aside from being vigilant. * Don't blindly add everything to git. * Check staged files before commit. * Store secrets separately, outside of your git folder (e.g. use another folder, service or environment variables). * If it must be in your git folder, then make use of .gitignore and store keys, etc separately from code in files with a unique file name pattern.