People leave private keys in repos all the time. I'm pretty sure this talk goes over it pretty well. https://www.youtube.com/watch?v=AwUJ9vpR7Vg