Ask HN: Best practice to prevent credentials/secrets commit to Git repo

Hi HN friends, it's july 2026 and I am assuming many of you use fully agentic building now. Securing secrets and credentials from being committed to GitHub repo has been even more critical. What's your best practice nowaday?

Thx