title: How to make sure API tokens & passwords stay off github
body: <p>I am considering publishing a project on github. It may contain sensitive data like API tokens, which I naturally do not want to be public. I would like to use the code locally with correct tokens, passwords etc, but only placeholders should go to the repository.</p>
  
  <p>I could try to remember to remove this data every time before pushing (manually, automatically?), but then local and github copies are obviously different, and this seems error-prone anyhow. </p>
  
  <p>What is good practice for this situation? </p>