I use only one remote with gateway where public mirror is synced separately, on purpose. So my dev machine and agents on it have no final repo forge credentials. Gateway sits between dev machine and final repo forges and holds credentials.
It's good to remind the community about this periodically