highSecrets and API keys

.env File Not in .gitignore

Your project uses dotenv to load .env files but may not have them in .gitignore.

Why it matters

If .env files are committed to git, your database passwords, API keys, JWT secrets, and other credentials become visible to anyone with access to the repository. Even in private repos, this violates the principle of least privilege. Once committed, secrets persist in git history even after deletion.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

dotenv require
require('dotenv').config();
const apiKey = process.env.API_KEY;

The smallest fix

minimal patch
# Add to .gitignore:
.env
.env.local
.env.*.local
.env.production
.env.development

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] loads dotenv: [the flagged code]. Verify that .env, .env.local, and .env.*.local are listed in .gitignore. If not, add them immediately. If .env was previously committed, rotate all secrets it contained.

How to check the fix worked

1. Check .gitignore contains .env patterns
2. Run `git ls-files .env` — should return empty (not tracked)
3. Verify .env.example exists with placeholder values (not real secrets)

Further reading