Ask HN: What are the best automated tools for keeping credentials out of GitHub?

I've a new client, a fast growing startup. Their security situation is a mess and I'm trying to get it under control. I'd love to hear anyone's strategies for imposing security on what has been an insecure system. Especially automated tools for basic stuff, like keeping API credentials out of Github.