.env and secrets files listed in .gitignore

A .gitignore that does not exclude .env files is a latent trap: any developer who creates .env.production or .env.local and runs git add . will commit production secrets to version control. CWE-312 (Cleartext Storage of Sensitive Information) and CWE-798 (Hard-coded Credentials) both apply — the git object database stores secrets permanently, surviving git rm. OWASP A02 (Cryptographic Failures) and NIST 800-53 SC-28 require protecting credentials at rest. A public repository with an accidentally committed .env file exposes database passwords, API keys, and signing secrets to the entire internet.

Add comprehensive secret file exclusions to .gitignore:

# .gitignore — secrets section
.env
.env.*
!.env.example
*.pem
*.key
serviceAccount.json
firebase-adminsdk-*.json

If a .env file is already tracked, remove it from git's index without deleting it:

git rm --cached .env
git rm --cached .env.production

# Verify no secret files remain tracked:
git ls-files | grep -E '\.env|\.key|\.pem'

If secrets appear in git history, rotate them immediately — history cleaning with git filter-repo does not invalidate credentials already harvested by CI or forks.