cypherpunks , 1 month ago

At my workplace, we use the string @nocommit to designate code that shouldn’t be checked in

That approach seems useful but it wouldn’t have prevented the PyPI incident OP links to: the access token was temporarily entered in a .py python source file, but it was not committed to git. The leak was via https://docs.python.org/3/tutorial/modules.html#compiled-python-files which made it into a published docker build.