If you push a secret key you should definitely generate a new one. Way to many bots out there that scan new commits for exactly that reason

Obviously you go and change the key instead?

You are correct in principle, but Lemmy isn't on a blockchain. It's much less permanent.

that's already a concern. what if someone just cloned your repo? there's also plenty of people that mirror public repos to their personal forgejo server. forgejo makes it very easy.

the only solution to mitigate such a mistake is to
1) invalidate the token
2) remove the commit

In that order.

I did not mean decentralized hosting of the projects (e.g. your project will be on all instances).

I meant decentralized account usage (e.g. you can use your example.com forgejo account to create an issue on otherexample.org)... Just like Lemmy... I could use my reddthat.com lemmy account to create a post on your instance lemmy.world without having to register there.

You can make commits on your system without pushing them to the remote server, and that’s the default behavior.