GitHub
Code quality
Security & compliance
Missing .gitignore coverage for env files
Part of the Secret hygiene check · fix arrives as a pull request
What it is
.gitignore does not cover the environment-file patterns the project uses, so an .env file is one git add . away from being committed.
Why it matters
It is the cheapest possible preventive control, and its absence is how most committed secrets get committed — nobody intends to, the file just was not ignored.
How to fix it
Add .env and its variants — .env.local, .env.*.local, .env.production — to .gitignore, keeping .env.example explicitly unignored so the documented list still ships.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.