highSecrets and API keys

.env File Not Ignored by Git

Your .env file, which holds real secrets, is not kept out of git.

Why it matters

If .env is committed, every database password, API key and token in it goes to everyone who can see the repository, and it stays in the history even after you delete the file. AI tools often create .env for you but do not touch .gitignore.

The smallest fix

minimal patch
# Add to .gitignore:
.env
.env.*
!.env.example

# If .env was already committed, remove it from the index (keeps your local file):
git rm --cached .env
git commit -m "stop tracking .env"

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
# Keep a committed template with placeholder values so teammates know
# which variables exist:
#   .env.example
#   DATABASE_URL=
#   OPENAI_API_KEY=
# And rotate every secret that was ever committed. Deleting the file
# does not remove it from history.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The project's .env file is not excluded from git ([the flagged code]). Add `.env` and `.env.*` to .gitignore, keep `.env.example` allowed, and if .env is already tracked run `git rm --cached .env`. Remind me to rotate every secret in it if it was ever committed.

How to check the fix worked

1. Run `git check-ignore .env`; it should print `.env`.
2. Run `git ls-files .env`; it should print nothing.
3. Confirm .env.example exists with placeholder values only.

Further reading