You should be using automated checks to keep credentials out of your repo, not relying on individual developers. And those checks can have explicit exceptions f

You should be using automated checks to keep credentials out of your repo, not relying on individual developers. And those checks can have explicit exceptions for known safe/public/test keys, just like you might explicitly allow testing or fake credit card numbers.