Fixes › Env vars & leaked keys

.env file committed to GitHub

CursorReplitBolt

The error

GitHub secret scanning alert / .env visible in a public repo

Why it happens

The .env file wasn't in .gitignore when the AI tool or you committed. Deleting it in a later commit doesn't remove it from git history, and bots scrape public repos for keys within minutes.

How to fix it

1. Rotate every key that was in the file first.
2. Add .env* (except .env.example) to .gitignore and run git rm --cached .env.
3. Optionally purge history with git filter-repo, but rotation is what makes you safe.
4. Enable GitHub secret scanning and push protection.

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

Our .env file was committed to git. Add .env and .env.* (but not .env.example) to .gitignore, remove tracked env files from the index with git rm --cached, create a .env.example with empty values, and give me a checklist of every key name in the old file that I must rotate. Don't print any secret values.

FAQ

Is deleting the file enough?

No, it stays in git history; rotate the keys.

Private repo?

Still rotate. Collaborators, integrations and forks can see it.

Related fixes

• Supabase service_role key exposed in frontend code
• OpenAI / Stripe secret key leaked in the browser
• Environment variable is undefined in production
• OpenAI 429 'You exceeded your current quota' or a surprise AI bill