What if the main reason why people don't want to opensource their project is because they don't know how to use their secret keys without including them in the repo ?
Removing secrets was a lot of work - more than I expected - while we open-sourced the product.
I agree with your sentiment though. Handling secrets in a codebase is not something that it currently easy or standardised.
As an aside, BFG Repo Cleaner really helped a lot with cleaning things up: https://rtyley.github.io/bfg-repo-cleaner/
Once we've finished fully open sourcing everything, we should look to write up our experience around the conversation, in particular, the tools we used.