Keeping secrets and junk out of Git

Everything you commit and push stays in the project's history, even if you delete the file later. So never commit passwords, API keys (secret codes that let your program use a service) or database connection strings. Automated bots scan public GitHub repositories for leaked keys within minutes.

Keep secrets in environment variables (settings your program reads when it starts) or in a .env file. List that file in .gitignore, the file that tells Git what never to track. Add build output, dependency folders such as node_modules or venv, and editor files too.

If a key does leak, revoke it (cancel it) at the provider straight away. Deleting it in the next commit is not enough: the key is still in the history, and bots may already have a copy. Undoing mistakes in Git cannot take it back once it is public. Set up .gitignore when you create a repository, not after the first accident.