Home / Save your work (GitHub) / Ignore secrets before you write any

Ignore secrets before you write any

Q: I already committed a key

Assume it is burned. Revoke it at the provider. Then: bash git rm --cached .env git commit -m "Stop tracking .env" git push Removing it from git does not erase it from history. For a first-app repo, delete the GitHub repo and make a new one. For anything real, rotate the key and treat the old repo as public.

Updated Sep 18, 2026

A .gitignore is cheaper than rotating every API key you accidentally committed.

Before you start:Create a GitHub repo

Create these two files in the repo folder before any agent starts generating .env files.

.gitignore:

.gitignore

node_modules
.next
.vercel
.env
.env.*
!.env.example
.DS_Store

.env.example (safe to commit):

Terminal

# Copy to .env and fill in real values. Never commit .env.
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GEMINI_API_KEY=

Then snapshot:

Terminal

git add .gitignore .env.example
git commit -m "Ignore env files before they exist"
git push -u origin main

If git says the branch is master, push master instead, or run git branch -M main once.

I already committed a key

Assume it is burned. Revoke it at the provider. Then:

Terminal

git rm --cached .env
git commit -m "Stop tracking .env"
git push

Removing it from git does not erase it from history. For a first-app repo, delete the GitHub repo and make a new one. For anything real, rotate the key and treat the old repo as public.

Next: pick a driver — Claude Code, Codex, Grok, or OpenCode. After a URL exists, Env files, then Keys.

Checklist

Mark done

.gitignore lists .env
First commit is pushed
.env is not on GitHub

Saved in this browser. No account. Clearing site data wipes it.

Next: Your AI coding helper · Codex (OpenAI's version) · Grok (xAI's version) · OpenCode · Passwords & API keys

Get new guides and videos by email

One email when something new is up. No spam. Unsubscribe anytime.