Why must environment files be excluded from GitHub?

Why must environment files be excluded from GitHub?

Environment files often contain values specific to one developer or deployment, including database passwords, session secrets, and email tokens. Files carrying real credentials should stay out of the Git repository so sharing application code does not also share access to its services.

Distinguish secrets from setup documentation

A local wedding application might use a credential-bearing database URI and an email token. Those values belong in protected local configuration or the hosting environment's secret facility.

A sanitized .env.example file can be committed. It should list required variable names, fake placeholders, and brief setup notes. This allows another developer or AI agent to understand the application's configuration contract without copying someone else's credentials. Not every environment-related file is inherently secret; its contents determine what is appropriate to share.

Verify what Git actually tracks

Add the relevant local configuration paths to .gitignore before staging them, and inspect the proposed commit. Git's ignore rules concern untracked files; they do not automatically stop tracking a file already present in the repository. Git ignore behavior.

If an environment file is already tracked, remove it from tracking through the team's normal workflow while retaining any needed local copy. Do not assume that adding an ignore pattern removed the file from older revisions.

Treat earlier exposure separately

When a real credential has been shared, rotate or revoke it at the service and replace its deployment value. Historical cleanup may also be needed, but deleting a file or changing .gitignore does not revoke access.

Review nearby scripts, logs, and documentation for copied values. For example, an onboarding setup note should explain where to configure the session secret without reproducing it.

The aim is reproducible setup with separated credentials: the repository describes the required configuration, and each authorized environment supplies its own protected values.