A .env file is committed to the repository: what to do
Why it matters
A tracked .env file is a leak even if the repository is private today: every clone, fork and CI cache carries it. Remove it from the index, rewrite history if it held real values, and rotate them.
How to fix it
What to do: Add
If
.env and other secret files to .gitignore.# Environment files
.env
.env.local
.env.*.local
*.env
# Keys and secrets
*.pem
*.key
credentials.json
If
.env was already committed: git rm --cached .env.Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.
Related checks
- How to find and remove secrets committed to a Git repository
- Why .env must be in .gitignore (and how to check it is not already committed)
- Automated dependency updates with Dependabot or Renovate
- How to pin GitHub Actions to a commit SHA
- Least-privilege GITHUB_TOKEN permissions in workflows
- The pull_request_target trap in GitHub Actions