.gitignore

You might say

There are files I don't want Git to track, like secret keys and dependency packages. How do I exclude them?

Tell Git which untracked files should stay out of version control.gitignore patterns keep generated files, dependencies, local settings, and secrets from being added by accident. It does not remove files that are already tracked, and it should not replace secure secret management.

Know first

Git Env Var

index.html Trackedstyle.css Tracked.env Ignored

×.gitignoreKeep local secrets out of version control

Add .env to .gitignore

A .gitignore file tells Git which untracked files and folders it should ignore. It does not remove a file that has already been committed. If a secret was exposed, rotate or revoke it immediately.

When to use it

Ignore dependency folders
Exclude build output and caches
Keep local environment files out of commits
Share project-wide ignore rules

When NOT to use it

Assume it removes a file already committed
Ignore source files just to hide an accidental change
Commit a secret first and add it to .gitignore later
Use broad patterns without checking what else they match

Anatomy

.gitignore node_modules/ Dependency directory, npm install can be installed back at any time .next/ Build the product, npm run build will regenerate .env Key file, see {c:env-var}, should not be submitted to the repository .DS_Store Mac system generated file, has nothing to do with project code

Installed third-party packages; reinstall them from package.json and the lockfile

Build output that can be regenerated by running the build command

May contain secrets such as API keys and should not be committed

A small operating-system file unrelated to the project source code

Variants

Exact

.env

When you want to ignore files with this exact name

Directory

node_modules/

Add a trailing slash to ignore the entire folder

Wildcard

*.log

When all files with the same extension should be ignored

Negate

!keep.log

When an exclamation point should re-include a file ignored by an earlier rule

Typical use cases

node_modules

.gitignore

node_modules/ # Installed dependencies
.next/ # Generated build output
.env # Local secrets
.DS_Store # macOS metadata

Build folder

zsh — my-first-page

# When .gitignore is not written: $ git status Untracked: node_modules/ .next/ .env .DS_Store … (the list is very long) # After writing .gitignore: $ git status Changes not staged: modified: index.html The list only displays project files that need to be processed

Environment file

Create a new repository

Add .gitignore Node ▾

💡 For an existing project, open github.com/github/gitignore, find the Node template, and copy the rules your project needs.

Editor cache

⚠ .env was pushed to the remote repository

Treat the key as compromised immediately

Use the service provider to rotate or revoke the key, then create a replacement

Coordinate any history cleanup with the team and hosting provider. Rewriting shared history affects collaborators, branches, and open pull requests.

BFG and git filter-repo can help remove a secret from Git history, but forks, caches, and old clones may keep copies. Verify first that the exposed key no longer works.