GitHub
Security & compliance
Code quality
Committed .env file
Part of the Secret hygiene check · fix arrives as a guide
What it is
A .env file is committed to the repository.
Why it matters
These files exist precisely to hold the values that should not be in version control. The whole set is now in history and readable by everyone with access, including anyone who forked or cloned before you noticed.
How to fix it
Rotate every credential the file contains, remove it with git rm --cached, and add the pattern to .gitignore. Rotation is the part that actually closes the exposure.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.