Developers want to commit an mTLS wallet with their application source. What is the correct response?

1. Keep sensitive connection material out of source control and distribute it securely
2. Commit it if the repository name contains private
3. Rename the archive to hide its purpose
4. Put it in a public issue attachment instead