School · Module 1 · Lesson 1 of 4
Keep .env files out of git
If a key lands in git history, deleting the file is not enough.
Put .env, .env.local and .env.*.local in .gitignore before you create them. AI coding tools often write env files for you; check the ignore list in the same PR.
If a file was already committed, rotate every key in it, then remove it from history with git filter-repo or BFG. Force-pushing a delete of the tip commit alone leaves the blob reachable.
Turn on GitHub secret scanning and push protection, or run gitleaks in CI, so the next leak is blocked before it is pushed.