Just recently I stumbled upon a vulnerability in some websites we are hosting. I don’t usually push these to remote repositories but keep them only in the local git repo to create an additional backup layer in case of breaking updates, etc.
Personally, I like to add an underscore prefix to files which I either don’t want under version control or not being exposed by the http server.