The problem is that those developers are also going to forget to update the ignore-by-default .gitignore to allow files, so there will be missing files. And they won't see any problems, because it works on their machine.

That's fixed by having the CI server compile the code and run tests, and having it fail the merge and publicly shame the offender in slack when that happens.

It's often said that you can't fix behavioral problems with technology, but I've found that tooling that strictly enforces rules is really useful.

In my opinion this will pretty quickly solve itself though. Accidentally committing keys to the repo potentially ruins your entire week. With a default disallow all list, you might have one bad deploy oopsie and then commit the files.

It's at least easy to fix.

Not pushing a file has a much easier fix than pushing an API key. The damage is also very different.

Sure, both have failure modes but the effect of the failure is different and acting like they're the same isn't helpful to finding solutions