Tracked node_modules (643), dist (155), and .env — secrets exposure risk #22

New issue

Closed

opened 2026-05-13 02:07:28 +00:00 by Mark · 1 comment

Mark commented

2026-05-13 02:07:28 +00:00

Owner

Problem

This repo has 799 tracked files that should be gitignored, including a committed .env file (secrets exposure risk):

Category	Count
`node_modules/`	643 files
`dist/`	155 files
`.env`	1 file

Impact

Secrets exposure: .env is committed — if it contains API keys or DB passwords, they're in git history
Build artifacts clutter the repo
GSD pipeline false positives on generated file changes

Fix

# Ensure gitignore covers everything
grep -q "node_modules/" .gitignore || echo "node_modules/" >> .gitignore
grep -q "dist/" .gitignore || echo "dist/" >> .gitignore
grep -q ".env" .gitignore || echo ".env" >> .gitignore

# Untrack (cached — won't delete from disk)
git rm --cached -r node_modules/
git rm --cached -r dist/
git rm --cached -- .env

# Commit
git add .gitignore
git commit -m "chore: untrack node_modules/ dist/ .env — gitignore artifacts"
git push origin main

Security Note

If .env was previously committed (not just staged), the secrets are in git history permanently. Consider:

Rotating any credentials that were in the file
Using git filter-repo to purge from history if needed

## Problem This repo has **799 tracked files** that should be gitignored, including a **committed `.env` file** (secrets exposure risk): | Category | Count | |----------|-------| | `node_modules/` | 643 files | | `dist/` | 155 files | | `.env` | 1 file | ## Impact 1. **Secrets exposure**: `.env` is committed — if it contains API keys or DB passwords, they're in git history 2. Build artifacts clutter the repo 3. GSD pipeline false positives on generated file changes ## Fix ```bash # Ensure gitignore covers everything grep -q "node_modules/" .gitignore || echo "node_modules/" >> .gitignore grep -q "dist/" .gitignore || echo "dist/" >> .gitignore grep -q ".env" .gitignore || echo ".env" >> .gitignore # Untrack (cached — won't delete from disk) git rm --cached -r node_modules/ git rm --cached -r dist/ git rm --cached -- .env # Commit git add .gitignore git commit -m "chore: untrack node_modules/ dist/ .env — gitignore artifacts" git push origin main ``` ## Security Note If `.env` was previously committed (not just staged), the secrets are in git history permanently. Consider: - Rotating any credentials that were in the file - Using `git filter-repo` to purge from history if needed