The .gitignore Mistakes That Leak Secrets (And Templates That Prevent Them)

A missing .gitignore entry is usually harmless — an extra node_modules folder bloating a repo, a stray .DS_Store file cluttering a diff. Occasionally it's how an API key ends up permanently in a public repo's history, findable by anyone who knows to look.

What actually needs to be in there

For a typical Node project:

node_modules/
dist/
build/
.env
.env.local
*.log
.DS_Store

For Python:

__pycache__/
*.pyc
.venv/
venv/
.env
*.egg-info/

Across nearly every project, regardless of language:

.env
.vscode/
.idea/
.DS_Store
Thumbs.db

The pattern that causes real damage isn't node_modules — it's .env. That file usually holds API keys, database credentials, or signing secrets, and it's exactly the kind of file that's easy to forget to exclude on a new project, especially if you copied a starter template that didn't include it.

The part that actually matters: what happens if it's already committed

Adding a file to .gitignore only stops git from tracking it going forward. If .env was already committed before you added the ignore rule, it's sitting in your git history whether the current working directory shows it as ignored or not — git status looking clean doesn't mean the file is gone from history.

Removing it properly takes two separate steps:

git rm --cached .env
git commit -m "Remove .env from tracking"

That stops future commits from including it, but the file is still recoverable from every commit before that point. If the repo has ever been pushed to a remote — GitHub, GitLab, anywhere — assume the secret has been exposed, because forks, clones, and cached views can retain the old history even after you rewrite it locally. The actual fix isn't cleaning git history (though tools like git filter-repo or BFG Repo-Cleaner exist for that); it's rotating the credential. Generate a new key, update wherever it's used, and revoke the old one. Removing it from history without rotating it just makes the exposed key harder to find, not invalid.

Building the file itself

The .gitignore Generator builds a proper file for your specific language, framework, or IDE combination instead of you copy-pasting a template from a five-year-old Stack Overflow answer that's missing whatever your specific toolchain generates. Combine multiple presets — Node + macOS + VS Code, for instance — for a project that spans more than one of these categories.

Try the .gitignore Generator →