islegit

3 minute read

Never commit your .env file

If you pushed API keys or a .env file to GitHub, revoke or rotate the keys at the provider immediately, because bots scan GitHub for leaked keys within minutes. Deleting the file or the commit is not enough; the key stays in Git history and in any copies already taken. After rotating, add .env to .gitignore so it never happens again.

Prevent it

  1. Before your first commit, create a .gitignore file containing .env and .env.*.
  2. Keep a .env.example with the names of the variables but no values.
  3. Put real values in your host’s environment settings, not in code.
  4. Turn on GitHub’s secret scanning and push protection. It blocks many keys before they are pushed.

If it already happened

  1. Rotate the key now. Go to the provider (OpenAI, Stripe, AWS, Supabase…) and create a new key, then delete the old one.
  2. Check the bill and logs for use you did not make.
  3. Update the new key in your host’s environment settings.
  4. Optionally clean the history, but only after rotating. Cleaning does not un-leak a key.

Tell your AI agent

Add a line to your agent’s instructions file: “Never write secrets into code. Never commit .env files.” Agents follow it.

Related

Next