How to Set Up a .gitignore to Prevent Future Credential Leaks

Use this at the very start of any new project, even before there's anything sensitive to protect yet, it's a cheap safety net for future you.

Steps

1. Create a .gitignore file at the repo root, before your first commit if possible.
2. Add the obvious candidates: environment files, keys, local override configs.
3. Commit the .gitignore itself early, so it's actually in effect before anything risky gets created in the project.

Gotcha

A .gitignore only prevents files from being added going forward, it does nothing for something already committed and pushed. If a secret was already committed before the .gitignore existed, adding the rule afterward doesn't remove it from git history, that requires a separate cleanup (like rewriting history or rotating the exposed credential). This is exactly why setting it up early matters more than setting it up thoroughly later.

Quick reference

# .gitignore starter for most self-hosted projects
.env
.env.*
*.pem
*.key
docker-compose.override.yml
.DS_Store