Secrets and .env

Keep .env files out of git

How to make sure .env files are never committed, find ones that already were, and what to do about keys in git history.

Why it matters

Anything you commit can end up public: a repo flipped to public, a fork, a shared zip. Bots scan GitHub for API keys continuously and use them within minutes of a push. AI tools often create a .env file and forget to ignore it.

How to fix it

1. Add these lines to .gitignore at the repo root.
2. Check whether any env file is already tracked with git ls-files | grep -i env.
3. If one is tracked, stop tracking it with git rm --cached .env and commit.
4. Treat every key that was in that file as leaked and rotate it. Removing the file does not remove it from history.

.env
.env.*
!.env.example

How to verify

• git ls-files | grep -i env returns only .env.example or nothing.
• git check-ignore -v .env.local names your .gitignore rule.

Questions

Is .env.example safe to commit?

Yes, if it contains only variable names and placeholder values, never real keys.

Does deleting .env in a new commit remove the keys?

No. They stay in git history and in any clone or fork. Rotate the keys.

Related checks

• Rotate leaked keys, don't just delete them
• Turn on secret scanning
• No secret keys in the browser bundle

Tick it off in the full checklist