.gitignore
A .gitignore file lists file and folder patterns that git should never track or commit, commonly including .env, credentials files, and build artifacts. It only affects files that are not already tracked, adding a pattern after a file was committed does not remove its history.
Why it matters
A missing or incomplete .gitignore is one of the most common ways a secret ends up in a public repository, often because a .env file was created before .gitignore was set up, or a new secret file was added under a name the existing patterns don't match.
Does .gitignore protect a file that's already committed?
No, it only prevents new commits from including a file. An already-tracked file needs to be explicitly removed.
Should every project have a .gitignore?
Yes, as a basic habit, especially any project that might ever hold a .env file or local credentials.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.