GitHub does warn you when you have API keys in your repo. Alternatively, there are CLI tools such as TruffleHog you can put in pre-commit hooks to run before commits automatically

You can use git hooks. Pre-commit specifically.

https://git-scm.com/docs/githooks

Already mentioned it in another reply, but .env and passing secrets as environment variables are a tragedy. Take a look at how SecureStore stores secrets encrypted at rest, and you’re even advised to commit them to git!

https://github.com/neosmart/securestore-rs

At least you can put .env in the global gitignore. I haven’t committed DS_Store in 15 years because of it - its secrets will die with me.

aside from already mentioned hooks you can add global .gitignore for .env files