Setting up a new Gatsby project as the quick start guide suggests will commit your projects API keys

[wildpow]

Description

Using npm init gatsby as the quick start section of Gatsby's docs suggest will add any API keys entered to the project initial commit.

Steps to reproduce

Step 1: npm init gatsby
Step 2: Choose a CMS or Google Analytics and enter the API key.
Step 3: Check the initial commit of the newly created project.

Expected result

The CLI creates both a .evn.production file and a .env.development file with API keys to the root of the newly created project. The gatsby-config.js file will reference them through process.env and add these files to the .gitignore.

Actual result

CLI creates a gatsby-config.js file with user-entered API keys hardcoded in their respective plug-ins then adds this file to the project's initial commit.

Environment

System:
OS: macOS 10.15.7
CPU: (8) x64 Intel(R) Core(TM) i7-7820HQ CPU @ 2.90GHz
Shell: 5.7.1 - /bin/zsh
Binaries:
Node: 14.13.0 - /usr/local/bin/node
Yarn: 1.22.4 - /usr/local/bin/yarn
npm: 7.5.4 - /usr/local/bin/npm
Languages:
Python: 2.7.16 - /usr/bin/python
Browsers:
Chrome: 89.0.4389.90
Firefox: 86.0
Safari: 14.0.3
npmPackages:
gatsby: ^3.0.1 => 3.1.0
gatsby-plugin-google-analytics: ^3.1.0 => 3.1.0
gatsby-plugin-image: ^1.1.0 => 1.1.0
gatsby-plugin-manifest: ^3.1.0 => 3.1.0
gatsby-plugin-react-helmet: ^4.1.0 => 4.1.0
gatsby-plugin-sharp: ^3.1.0 => 3.1.0
gatsby-plugin-sitemap: ^3.1.0 => 3.1.0
gatsby-plugin-styled-components: ^4.1.0 => 4.1.0
gatsby-source-datocms: ^2.6.6 => 2.6.6
gatsby-source-filesystem: ^3.1.0 => 3.1.0
gatsby-transformer-sharp: ^3.1.0 => 3.1.0
npmGlobalPackages:
gatsby-cli: 3.1.0

[wildpow]

I don't agree with this being moved to 'Ideas / Feature Requests'. That would assume this process's intended function is to commit user's sensitive data to Github. I think this was just an oversight and a bug fix would be in order.
I assuming the quick start guide is designed for people new to Gatsby and or new to development, so wouldn't the best practice be to store sensitive information in .env files and not commit them?

If the analytics suggest very few people use this method to creating a new Gatsby project then the 'idea' or 'feature request' is to get rid of the quick start docs all together which may save a few new people from doing this even if it's still a feature of the cli.