.gitignore, done right.

Keep .env files and other unwanted files out of new commits with a stack-specific .gitignore. Existing secrets in Git history still need separate remediation.

The commit you can’t take back

Git history is permanent by design, which is wonderful for code and terrible for secrets. The moment a .env or a key is pushed to a remote, it is effectively public — deleting it in a later commit leaves it sitting in history, and automated scanners crawl public repos for credentials constantly. A correct .gitignore, in place before your first commit, is the cheap insurance against the single most common way developers leak production secrets.

Keeping secrets out of git is one habit in a larger discipline: secrets belong in a controlled, auditable place, not scattered through repos, configs, and chat. Managing that across the backend you own is part of what a control plane is for.