- Home
- The 17 checks
- Your .env file is committed
Your .env file is committed
In plain English: Your .env file holds your app's secret keys. It has been saved into git, the history of your project, so anyone with a copy of the project, now or later, can read every key in it.
What happens if you ship it
Every secret in that file is now in your git history, including every fork and clone of it.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: Your .env file is committed. Add .env to .gitignore, run git rm --cached on the file, and rotate every value it contained. Deleting the file later does not remove it from history. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as env-file-committed, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
Does deleting the .env file fix it?
No. Git keeps every old version, so the keys stay in the history. Stop tracking the file, add it to .gitignore, and replace every key it contained with a new one.
What is .gitignore?
A list of files that git should never save. Your .env file belongs on it, so secrets stay on your computer and your host's settings, not in the project history.