Second that, if there are many people having access to the repository and you maintain repo&#x27;s history, rotating encryption keys and secrets won&#x27;t save you, unless you also delete the whole history and do some major updates to the files. 
Someone can answer to that that he can put the ciphertests in a separate repository and limit repo&#x27;s access to only deployment server&#x2F;user, but that completely invalidates the goal.