While the author is down on automatic file name scans, I see nothing wrong in using tools to catch easy mistakes. How many people do regular code &#x2F; package reviews? Did not think so.
I recommend: 
- <a href="https:&#x2F;&#x2F;github.com&#x2F;jandre&#x2F;safe-commit-hook" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jandre&#x2F;safe-commit-hook</a>
- my fork of the above for NPM js workflow <a href="https:&#x2F;&#x2F;github.com&#x2F;bahmutov&#x2F;ban-sensitive-files" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bahmutov&#x2F;ban-sensitive-files</a>
- NPM checklist that includes sensitive file reviews <a href="https:&#x2F;&#x2F;github.com&#x2F;bahmutov&#x2F;npm-module-checklist" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bahmutov&#x2F;npm-module-checklist</a><p>Finally, if GitHub can automate some of the simple checks, so can we, for different tools and environments of course.