Perhaps Github, by default, should add its own .gitignore that ignores files with certain keyword and have it only allowed to override by repo setting.

I've seen too many incidents when an engineer checks in a plaintext password to a repo