Missing .gitignore — risk of committing secrets, tokens, or virtual environments #9

New issue

Closed

opened 2026-05-09 00:19:59 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 00:19:59 +00:00

Owner

Bug

Date: 2026-05-08
Severity: Low-Medium (security/hygiene)

Summary

The repository has no .gitignore file. While the repo currently only contains documentation and markdown files, the README promises scripts (health checks, backups, cleanup) which could involve:

API tokens or service credentials
Environment variable files (.env)
SSH keys or config files
Python virtual environments (venv/.venv)
IDE/editor config files (.vscode/, .idea/)
OS metadata files (.DS_Store, Thumbs.db)
Log files from script runs

Without a .gitignore, these could accidentally be committed and pushed to the Forgejo remote.

Suggested Fix

Add a .gitignore covering at minimum:

.env
.env.*
__pycache__/
*.pyc
.venv/
venv/
.vscode/
.idea/
*.log
.DS_Store
Thumbs.db
node_modules/
*.token
secrets/
config-with-tokens.*

Tags

#infrastructure #security #git

## Bug **Date:** 2026-05-08 **Severity:** Low-Medium (security/hygiene) ## Summary The repository has no `.gitignore` file. While the repo currently only contains documentation and markdown files, the README promises scripts (health checks, backups, cleanup) which could involve: - API tokens or service credentials - Environment variable files (.env) - SSH keys or config files - Python virtual environments (venv/.venv) - IDE/editor config files (.vscode/, .idea/) - OS metadata files (.DS_Store, Thumbs.db) - Log files from script runs Without a `.gitignore`, these could accidentally be committed and pushed to the Forgejo remote. ## Suggested Fix Add a `.gitignore` covering at minimum: ``` .env .env.* __pycache__/ *.pyc .venv/ venv/ .vscode/ .idea/ *.log .DS_Store Thumbs.db node_modules/ *.token secrets/ config-with-tokens.* ``` ## Tags #infrastructure #security #git