# .gitignore

Canonical page: /glossary/gitignore

API keys & secrets glossary, Mistakes & leaks. .gitignore: Keeping Secrets Out of Version Control

**Short answer:** A .gitignore file lists file and folder patterns that git should never track or commit, commonly including .env, credentials files, and build artifacts. It only affects files that are not already tracked, adding a pattern after a file was committed does not remove its history.

## Why it matters

A missing or incomplete .gitignore is one of the most common ways a secret ends up in a public repository, often because a .env file was created before .gitignore was set up, or a new secret file was added under a name the existing patterns don't match.

## In Claude Keychain

Claude Keychain sidesteps the .gitignore problem for API keys entirely, since there is no file holding the key for a pattern to need to match in the first place.

## Common questions

**Does .gitignore protect a file that's already committed?**

No, it only prevents new commits from including a file. An already-tracked file needs to be explicitly removed.

**Should every project have a .gitignore?**

Yes, as a basic habit, especially any project that might ever hold a .env file or local credentials.

## Related

[.env file](/glossary/env-file), [Secret leaked in git history](/glossary/secret-in-git-history), [Secret scanning](/glossary/secret-scanning)