I asked it to 'commit everything'. It did. The repo is private, but still. !screenshothttps://snclgxzfzjnurkzmevyx.supabase.co/storage/v1/object/public/post-ima

Question

Claude Code committed my .env.local to GitHub

Solved · 3901 viewsasked last month by

sam_builds

I asked it to 'commit everything'. It did. The repo is private, but still.

What I’ve tried

Deleted the file in a new commit.

Comment

Rotate first, clean history after. Order matters.

chidi_eze last month

2 answers

Marked as helpful by the asker

lena_opslast month

Deleting in a new commit does nothing; the keys are in history. Two steps, today: rotate every key in that file (Supabase, Resend, Stripe), then add .env* to .gitignore and git rm --cached .env.local. Rewriting history is optional once the keys are dead. And never say 'commit everything' again; say 'commit the files you changed'.

Comment

Rotated Supabase, Resend and Stripe. Took 40 minutes.

sam_builds last month

Is it worth rewriting history too?

sam_builds last month

For a private repo, rotating is what matters. git filter-repo if you want it clean, but the old keys are dead anyway.

lena_ops last month

Did the same last year. GitHub secret scanning emailed me before I noticed. nightshiftbuilder 4 weeks ago

dmitri_vlast month

For next time, turn on push protection in the repo settings (Code security → Secret scanning → Push protection). GitHub then rejects a push that contains a recognised key, Stripe and Supabase service keys included, before it's in the remote history at all.

Locally, a pre-commit hook with gitleaks protect --staged does the same one step earlier.

Comment

Push protection is on. Tested it with a fake key, the push got rejected.

sam_builds last month

Keyboard shortcuts

Claude Code committed my .env.local to GitHub

What I’ve tried

2 answers

Your answer

Claude Code committed my .env.local to GitHub

What I’ve tried

2 answers

Related

Your answer