DarnlyA .gitignore that keeps your secrets safe
Pick your stack and get a .gitignore that keeps your .env files, private keys and service accounts out of git. Already have one? Check it and see in red anything that would leak. Nothing leaves your browser.
Your keys stay out of git. 15 highlighted lines cover .env files, private keys and service accounts.
Already committed a .env file? A .gitignore won’t take it back out. Check yours to see what’s exposed, and run the API key leak checker on your live site.
This is an example. Replace it with yours: run git status in your project folder and paste what it prints, or ask your AI agent to run it. Only file names are needed, never what’s inside them.
More free tools
How it works
- Pick your stack, your computer and your editor. The .gitignore updates as you click, with the lines that keep your keys out of git highlighted.
- Copy it, download it, or copy a prompt that asks Claude Code, Cursor or Codex to add it and untrack anything that’s already committed.
- Already have a .gitignore? Open “Check mine”, paste it with your git status, and see in red every secret file that would leak, with a prompt to fix each one.
Questions
What is a .gitignore?
A plain text file in the top folder of your project. Each line names files or folders that git should leave out, like node_modules or your .env file. Files it matches are never added when you or your AI agent run “git add .”, so they never reach GitHub.
Why does it matter so much for .env files?
Your .env file holds your API keys and database passwords. If it gets committed and pushed, anyone who can see the repo can copy them, and bots scan public GitHub for new keys within minutes. One line, .env*, keeps every .env file out, while the !.env.example line keeps the example file in so others know which keys to set.
I added .env to my .gitignore, but it still shows up. Why?
A .gitignore only stops new files from being added. If .env was committed before, git keeps tracking it. Run git rm --cached .env (it stays on your disk), commit, and then rotate every key in it, because the old version is still in your git history. “Check mine” gives you a prompt that asks your AI agent to do all of this.
Is “Check mine” safe to use with my real files?
Yes. Everything runs in your browser and nothing is uploaded or saved. It only needs file names, never what’s inside them, so don’t paste the contents of your .env file.
How do I get my git status?
Open a terminal in your project folder (in Cursor or VS Code: Terminal, then New Terminal), type git status and press Enter, then copy everything it prints. You can also ask your AI agent: “run git status and show me the output”. A plain list of file names works too.
Should I ignore the .cursor or .claude folder?
No, keep them: .cursor/rules and CLAUDE.md are instructions your whole team (and your agent) should share. Only ignore the personal or secret files inside them: .cursor/mcp.json, which often holds API keys for your MCP tools, and .claude/settings.local.json.