Well, I have one well-documented exception to this rule: Secret detection. You really don't want to push secrets to your repository, especially if it's hosted a

Well, I have one well-documented exception to this rule: Secret detection. You really don't want to push secrets to your repository, especially if it's hosted as public on GitHub. Those damned attackers can find the secrets in minutes after you've pushed them so you really don't have the time to catch and rotate this (unless you're able to properly attribute and rotate them from the CI... in which case, I'd love to see it).