.env files are listed in .gitignore

A .env file committed to git is a permanent credential leak — even after deletion, the file lives in git history and is readable to anyone with repository access, including all future contributors, CI/CD systems, and anyone who ever clones the repo. Stripe keys, database passwords, and OAuth secrets committed to a private repo are exposed the moment the repo is accidentally made public or an employee account is compromised. OWASP A02 (Cryptographic Failures) covers secret exposure; CWE-540 and CWE-538 specifically address sensitive information in committed files. AI code generators routinely create .env.local files and forget to update .gitignore, making this one of the highest-frequency findings across AI-built projects.

Add .env patterns to .gitignore before committing any environment files. If .env files are already tracked, remove them from git's index immediately.

# .gitignore — add all of these
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
.env*.local

If secrets were already committed: git rm --cached .env.local, then commit the removal, then rotate every secret in that file immediately — treat them as compromised. Only .env.example with placeholder values should ever be committed.