Even if it’s private don’t put keys in the repo