Yeah, I'm not sure why this is such a problem. At work we tried out using detect-secrets[1] for a while to make sure we didn't accidentally commit anything imp

Yeah, I'm not sure why this is such a problem. At work we tried out using detect-secrets[1] for a while to make sure we didn't accidentally commit anything important. It was a huge pain, it picked up nothing but false positives. After a few months we decided that our pre-existing practices: have secrets passed to the app in environment variables which are set during deployment, and use fake secrets for test and dev, solved the problem in a much less painful way. Is it so hard to keep real secrets separate from the source code? [1] https://github.com/Yelp/detect-secrets https://github.com/Yelp/detect-secrets