A credentials file, untracked and un-ignored, in a repo about to go public

A credentials file, untracked and un-ignored, in a repo about to go public `.sec` was sitting in the working tree holding live AWS credentials: not tracked, but not ignored either, and mode 644. One `git add -A` away from being committed, in the week this repository goes public. The pattern rather than the filename, because the next one will be called something else. `chmod 600` alongside, which is not in the diff but was the other half. Worth saying what the file turned out to contain, because it decides something: an `ASIA*` key with a session token — a temporary STS session from SSO, not a long-lived IAM user. Those expire in hours. They cannot be the nightly's credentials, and setting them would produce a scheduled job that passes once and then fails every night on an expired token, which is the same class of misleading signal the workflow's own comments were written about.