Instead of checking for secrets after the fact with Preflight, we could instead install a pre-commit Git hook that will check for them, as suggested in this tweet:
The only pre-commit hook you should have is one scanning commits for secrets and API keys.
We could add this with the scaffolder / starter command, which the install script in eslint-config-upleveled should turn into: