What not to commit

A key on the internet

Bots scan GitHub around the clock for passwords and API keys. A key pushed by accident is often abused within minutes. The fix starts before you commit: tell Git which files to ignore.

.gitignore

git init
echo "node_modules/" > .gitignore
echo ".env" >> .gitignore
echo "*.log" >> .gitignore
echo "API_KEY=abc123" > .env
echo "error" > debug.log
touch node_modules/react.js
echo "<h1>Hi</h1>" > index.html
git status
git add .
git commit -m "Add page and ignore rules"

Ignore: secrets (.env), dependencies (node_modules/), build output (dist/), logs and OS junk (.DS_Store).
Commit the .gitignore itself so the whole team shares the rules.
Already committed a file? git rm --cached file stops tracking it but keeps it on disk.
Leaked a secret? Revoke it immediately — it stays in history even after you delete it.

A key on the internet

.gitignore

The rest of this lesson