Block a credential at commit time with a pre-commit secret scanner, and make new repos get one without anyone remembering to ask.
