I'm not sure why in the "Easy Fixes" it doesn't say the thing that is mentioned in the next point "stop putting sensitive data into private repositories". That

I'm not sure why in the "Easy Fixes" it doesn't say the thing that is mentioned in the next point "stop putting sensitive data into private repositories". That should _also_ go in "Easy Fixes" IMHO, use environment variables, vaults, etc to not store your keys into your code.