https://github.com/github/gitignore/commit/
08def965cd1c0241a7cffbe7c26a74b3cab61243 incorrect states that commenting *.pubxml will keep your passwords hidden when it will actually do the opposite. This clarifies what commenting *.pubxml does and warns you of the dangers.
# Publish Web Output
*.[Pp]ublish.xml
*.azurePubxml
-# TODO: Comment out the next line if you want to keep your passwords hidden
+# TODO: Comment the next line if you want to checkin your
+# web deploy settings but any saved passwords will be unencrypted
*.pubxml
# NuGet Packages