> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again

If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to:

1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature.

2. When adding secrets, make sure they're encrypted or added to the project's `.gitignore` equivalent.

I'm so sorry for a first-world engineer incompetent enough to commit a secret in a GitHub repository. They'll probably have to downsize from their mansion to a regular house. Meanwhile in the third world, many more competent people are starving or working some terrible menial job because they didn't have the right opportunities in life...