Things don't have to be confidential to be an issue. Leaking the actual maintainer's names (as opposed to the Drupal list), for instance, would not necessarily be considered confidential, but still an issue if it showed up.

Usually passwords or keys are stored in a config file, and that is stored in a place outside the repo.