[hirako2000]

Or just have a good `.dockerignore`

When I create a project now I automatically place a catch all ignore for both git and docker.

Binaries, .env files have a far lower chance to end up tracked in a repo or copied over to a container image.

[zihotki]

Or just use CI/CD on a build server to create release artifacts and a proper security setup (no PAT's, or use short living one)