Back to overview
Risk
.env committed to Git by accident
A committed .env stays in history forever – even after you delete it.
.env files are the right place for secrets – as long as Git ignores them. If the right line is missing from .gitignore, the file lands in the repo with all its keys.
What happens
A git add . sweeps up the .env, the commit lands in the repo, and the next push puts it online. Often it's only noticed once the repo has already been shared.
Why it's dangerous
Git forgets nothing. Even if you delete the file later, it stays in history – anyone who cloned the repo has the old version, keys and all.
How Env Clinic helps
Env Clinic checks whether your .gitignore really protects .env files, and can optionally search the Git history for old leaks.
env-clinic scan . --include-git-history
- Checks the .gitignore rules
- Finds old leaks in history
- Gives you the exact protection lines