.gitignore — The Missing File That Exposed Production Secrets

The most common Git mistake is committing something sensitive — API keys, database passwords, .env files, or large binary files. .gitignore is the first line of defense. But it's often added reactively, after the damage is done. A single commit with a .env file means the secrets are in the repository history forever, even if you delete the file in a later commit. This guide covers gitignore patterns, the global gitignore, and the incident where a missing .env entry exposed production API keys within hours of the commit.

Gitignore Patterns: Syntax and Best Practices

.gitignore uses glob patterns: *.log ignores all files ending in .log. .env ignores .env in all directories (no leading /). /config.env ignores only the file at root. build/ ignores a build directory at any level.

Negation: !important.log overrides a previous *.log ignore. Comments: # This is a comment. Empty lines are whitespace.

Key patterns for every project: .env, .log, node_modules/, .pyc, __pycache__/, .DS_Store, dist/, build/, .idea/, .pem, .key.

git check-ignore -v <file> shows which pattern caused a file to be ignored and which gitignore file it came from. Use this to debug unexpected behavior.

# Create a basic .gitignore
echo '.env' >> .gitignore
echo '*.log' >> .gitignore
echo 'node_modules/' >> .gitignore
echo '.DS_Store' >> .gitignore

# Check if a file is ignored
git check-ignore .env
git check-ignore -v secrets.pem  # shows which pattern matched

# List all ignored files in the repo
git ls-files --others --ignored --exclude-standard

# See what's staged (before commit)
git status --short

# Set up global gitignore
git config --global core.excludesFile ~/.gitignore_global
cat > ~/.gitignore_global << 'EOF'
.env
.idea/
*.swp
.DS_Store
*.pem
*.key
*.log
EOF

# Pre-commit hook to prevent secrets
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
if git diff --cached --name-only | grep -E '\.env$' > /dev/null; then
  echo 'ERROR: .env file is staged! Aborting commit.'
  exit 1
fi
EOF
chmod +x .git/hooks/pre-commit