How should credentials and secrets be handled in a Git repository?

Passwords, API keys, access tokens, private keys, connection secrets, and similar credentials should not be committed to source control. Use appropriate secret stores, environment variables, local configuration excluded by .gitignore, or deployment-platform secret management.

If a secret is committed, deleting the file in a later commit is not enough because the value may remain in repository history, forks, caches, or clones. The credential should be revoked or rotated immediately, then repository history can be remediated when necessary.