"Employee posted his credentials into public repository", wondering what reason would have provoked him to do that in first place?
It’s part of the danger of having a public “dotfiles” repository. It’s very easy to check in your .zshrc, only to discover that some script added an ENV var that contains a secret. Alternatively, the employee could have checked in a script that contained some secrets.
Thats why you use precommit hooks with secrets scan.
Maltitude of those.