Your .env is still in your git history
Adding .env to .gitignore stops future commits, but it does not remove the file from history. Anyone who clones the repository can still read the old secret with a single command.
Your .env is in your git history. Right now.
At some point you committed a .env file. Later you noticed, added it to gitignore, and moved on. Git status is clean, the file is untracked, and everything looks fine. But gitignore only stops future commits. It does not touch what is already in the history.
Ask git directly. The log for that one path shows every commit that ever touched it, including the commit that removed it. Once you have that commit, you can read the file exactly as it was, and the old password is right there on your screen. Anyone who can clone the repository can run the same command.
Untracked is not the same as gone. If a secret was ever committed, treat it as leaked, rotate it, and then clean the history.
Check your own repository before someone else does.
#git#security#devops#linux#sysadmin
❯ Check your own repository before someone else does.