Never commit secrets to git, even in private repositories

Git keeps every version of every file forever, and repositories get cloned, forked, made public and copied to laptops. A secret committed once should be treated as exposed, even if you delete it in the next commit, and even in a private repository.

Set up your project so real values never get near a commit:

• Keep real values in .env files listed in .gitignore. The default create-next-app template already ignores them.
• Commit an .env.example with the variable names and dummy values, so teammates know what to fill in.
• Never add an exception that lets a real .env.production or similar file through.

To check, list what git tracks:

git ls-files | grep -i env

Only the example file should appear.