What Is .gitignore? Keeping Secrets and Junk Out of Git

Your project folder contains files that should never go into Git: secret keys, thousands of downloaded packages, build output, and your computer's hidden clutter. A small file called .gitignore keeps them out.

What it does

.gitignore is a plain text file in your project's top folder. Each line is a pattern. Files matching a pattern are ignored by Git: they don't show up in git status, and git add . skips them.

.env
node_modules/
dist/
.DS_Store

The name starts with a dot, which makes it a hidden file on macOS and Linux. Use ls -a in the terminal, or your editor's file explorer, to see it.

What to ignore

Secrets

.env
.env.local
.env.*.local
*.pem

Your .env file holds API keys and passwords. It must never be committed — anything committed to a public GitHub repository is found by automated scanners within minutes. (What Is an Environment Variable?.)

Many projects commit a .env.example instead: the same variable names with placeholder values, so others know what to set.

Dependencies

node_modules/
.venv/
vendor/

node_modules can be hundreds of megabytes. It's rebuilt from package.json and the lock file with npm install, so there's no reason to store it. (npm and package.json Explained.)

Do commit the lock file (package-lock.json, pnpm-lock.yaml, yarn.lock). It records exact versions so everyone installs the same thing.

Build output

dist/
build/
.next/
out/
coverage/

Generated by your build tools. Recreated on every build.

Logs, caches, and OS/editor clutter

*.log
.cache/
.DS_Store
Thumbs.db
.idea/

.DS_Store (macOS) and Thumbs.db (Windows) are created automatically by the operating system.

Pattern syntax

Pattern	Matches
`secret.txt`	A file with that name, in any folder
`/secret.txt`	Only at the project's top level
`logs/`	A folder named `logs`, and everything in it
`*.log`	Any file ending in `.log`
`**/temp`	`temp` in any folder, at any depth
`!keep.log`	Don't ignore this, even if an earlier rule did
`# comment`	Ignored line

A starter file for a JavaScript project

# Dependencies
node_modules/

# Environment and secrets
.env
.env*.local
*.pem

# Build output
dist/
build/
.next/
out/
coverage/

# Logs and caches
*.log
.cache/

# OS and editors
.DS_Store
Thumbs.db
.idea/

GitHub offers ready-made templates for most languages when you create a repository, and most project generators (like create-next-app) include one already. Check it's there and includes .env.

"I added it to .gitignore but Git still tracks it"

.gitignore only affects files Git isn't already tracking. If you committed a file before ignoring it, Git keeps tracking changes to it. Stop tracking it without deleting it from your computer:

git rm --cached .env
git commit -m "Stop tracking .env"

For a folder, add -r: git rm -r --cached node_modules.

If you committed a secret

Removing the file in a new commit doesn't remove it from history. Anyone with the repository can still find it in old commits — and if it was ever pushed to GitHub, assume it's been seen.

Revoke or rotate the secret immediately at the provider (create a new key, delete the old one). This is the step that actually protects you.
Stop tracking the file, as above, and add it to .gitignore.
Optionally, rewrite history to remove it (tools like git filter-repo), but only after rotating — rewriting doesn't un-leak anything.

I Leaked an API Key. What Now? walks through it.

Check before you commit

Two habits prevent most accidents:

git status            # look at what's about to be added
git diff --staged     # look at the actual content

And ask your AI tool to check too: Claude Code will warn you if it sees a secret about to be committed, but a .gitignore that's right from day one is the real protection.

EasySpawn keeps secrets in each workspace's server-side environment variables rather than in files you might commit, so your repository stays safe to share. See how it works or join the waitlist.