Not all config files have sensitive information.
I would say only "datasources.php" and maybe "email.php".

Having those files gitignored helps when running `cakephp/cakephp` tests on our CI servers.
Anything else should be done on userland IMO.