I think there are two root problems here; the first is human error/forgetfulness, and there's only so much you can do about that. The second, which I see on a

I think there are two root problems here; the first is human error/forgetfulness, and there's only so much you can do about that. The second, which I see on a daily basis from a small number of my colleagues, is a lack of understanding about security - by way of an example, we distribute a script to commercial partners that I've regularly had to expunge passwords for our Subversion repo from. Trying to explain the problem to the culprit gets nowhere because 'well, they can't access the repository without using our VPN', which of course is very far from the point... but nearly impossible to argue against without lecturing.