Stop secrets before commit.

Install a pre-commit guard that blocks .env files from entering source control. Catch mistakes at the moment they happen, before they become repository history.