.env files in .gitignore with no git history
Why it matters
A .env file committed to git — even once, even years ago — permanently exposes every secret it contained. Git history is not cleared by deleting the file from the working tree. Attackers who clone your repo, access a GitHub fork, or pull a leaked archive get your database passwords, API keys, and OAuth secrets instantly. OWASP A05 (Security Misconfiguration) and NIST SC-28 both flag unprotected sensitive data at rest. The blast radius is immediate: a single committed production .env means every secret in it is compromised and must be rotated before you do anything else.
Severity rationale
Critical because a committed .env file permanently exposes production credentials to anyone with repository access, making secret rotation mandatory regardless of when the commit occurred.
Remediation
Add .env patterns to .gitignore before any secrets are committed. If a .env file already exists in git history, treat every secret it contained as compromised and rotate them immediately — removing the file from the working tree does not remove it from history.
# .gitignore
.env
.env.local
.env.*.local
.env.production
.env.staging
.env.development
To scrub the file from history, run git filter-repo --path .env.production --invert-paths (preferred over filter-branch). After history rewrite, force-push all branches and notify all collaborators to re-clone.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Environment Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-538 — Insertion of Sensitive Information into Externally-Accessible File or Directory
- cwe · CWE-312 — Cleartext Storage of Sensitive Information
- owasp:2021 · A05 — Security Misconfiguration
- nist:rev5 · SC-28 — Protection of Information at Rest
- soc2:2017 · CC6.1 — Logical access security software, infrastructure, and architectures
- soc2:2017 · C1.1 — Identification and protection of confidential information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from environment-security·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC6.1, C1.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2