For people in the JS ecosystem theres this eslint rule: https://github.com/nickdeis/eslint-plugin-no-secrets