How to Avoid Uploading .env Files to GitHub

Go to github.com, sign in, and navigate to your repository. Click your **profile picture** in the top-right corner, select **Your repositories**, and click the repository name. You should see the file list on the main code tab.

Check if a .gitignore file already exists in the file list. If it does, click on it, then click the **pencil icon** (Edit this file) in the top-right of the file viewer. If it does not exist, click the **Add file** dropdown above the file list and select **Create new file**. Type `.gitignore` in the filename box.

In the editor, add the following lines. Each line blocks a different variant of environment files. If the file already has content, add these lines at the top or in a clearly labeled section. Make sure to include every common variation: `.env`, `.env.local`, `.env.development`, `.env.production`, and the wildcard `.env*.local` which catches all local overrides.

1# Environment variables — NEVER commit these
2.env
3.env.local
4.env.development
5.env.production
6.env*.local

Scroll down to the **Commit changes** area. Enter a descriptive message like 'Add .env files to .gitignore for security.' Keep the option set to **Commit directly to the main branch** and click the green **Commit changes** button.

If a .env file appears in your file list, it was already committed and .gitignore alone will not remove it. Click on the .env file to open it. Click the **three-dot menu** (⋯) in the top-right corner of the file viewer and select **Delete file**. Type a commit message like 'Remove .env — secrets should not be in repo' and click **Commit changes**. Critical: even after deletion, the file remains in your Git history. Anyone can see old commits and find the keys. Proceed to the next step immediately.

Click the **Settings** tab at the top of your repository. In the left sidebar, scroll down and click **Code security and analysis** (under the Security section). Find **Secret scanning** and click the **Enable** button if it is not already turned on. This feature scans your repository for patterns that look like API keys and sends you an alert if it finds any. On free accounts for public repositories, secret scanning is enabled by default. For private repositories, it requires GitHub Advanced Security (available on Team/Enterprise plans).

If your .env file was public even briefly, assume every key in it is compromised. Go to each service dashboard and regenerate keys: - **Supabase**: Project Settings → API → click 'Regenerate' next to the anon key - **Stripe**: Developers → API keys → Roll key - **OpenAI**: API Keys → delete the old key and create a new one - **Firebase**: Project settings → Service accounts → Generate new private key Update your local .env file with the new keys. If you need help auditing which keys were exposed and rotating them across multiple services, the RapidDev team can handle the full remediation process.