Policy to identify sensitive files that should not be in the repository

[david3107]

Files like .env contain most of the times plain text credentials. While these files should be added to the .gitignore list, sometimes they can be pushed to the repo by mistake , leaking API tokens, passwords or other sensitive info.

Policy proposed: disallow specific files

file-disallow:
     - .env
     - conf.xml

This policy could also check that these files are inside the .gitignore. We can use https://github.com/github/gitignore as reference and example.