How do I keep secrets out of a published pit?

Publish only the messages that matter. Using a selector to include just the relevant exchange is the simplest way to leave setup, keys and unrelated chatter out of a pit.

Review the selection confirmation before publishing, and remember you can start a pit as private, clean it up, and only then switch it to public.