Obsidian/X-Articles/The .gitignore That Saves Your Career (Full File Included).md

title, source, author, published, created, description, tags

title	source	author	published	created	description	tags
The .gitignore That Saves Your Career (Full File Included)	https://x.com/zodchiii/status/2050505359584788850	@zodchiii	2026-05-02	2026-05-02	Anthropic leaked 512,000 lines of their own source code because someone forgot to add one line to an ignore file. If it happens to them, it'...	clippings

Anthropic leaked 512,000 lines of their own source code because someone forgot to add one line to an ignore file. If it happens to them, it's happening to you.

Within hours the code was mirrored on GitHub and got 50,000 stars in two hours, likely the fastest-growing repository in GitHub history.

Your .gitignore is probably a template you copied on day one and never touched.

Here's what actually needs to be in it 👇

Before we dive in, I share daily notes on AI & vibe coding in my Telegram channel: https://t.me/zodchixquant🧠

Why default .gitignore templates aren't enough

GitHub's default templates cover the basics: node_modules, pycache, .DS_Store. They were written before AI coding tools existed.

In 2026 your project has new files that didn't exist two years ago:

.claude/           → Claude Code settings with API tokens in shell commands
.cursor/           → Cursor AI rules and configs
.aider*            → Aider chat history and configs
.env               → everyone knows this one, but...
.env.local         → ...most people forget this one
.env.development   → ...and this one
.env.production    → ...especially this one

The .claude/ directory is the newest threat. Claude Code stores your settings.json there, and if you've pre-approved bash commands with API tokens in them, those tokens are now sitting in a file that gets packaged into npm, PyPI, and RubyGems by default.

Lakera security researchers confirmed this in April 2026: build tools for Python, Ruby, and JavaScript all package files from your project directory.

If .claude/ isn't in your ignore file, your approved shell commands with embedded secrets ship to the public registry.

The files that actually leak

Based on real incidents from the past 12 months:

Tier 1 - secrets that cost money immediately:

.env, .env.local, .env.production, .env.development
.claude/settings.json (contains pre-approved commands with tokens)
*.pem, *.key (SSL certificates and private keys)
credentials.json, service-account.json (cloud provider keys)
.npmrc, .pypirc (package registry tokens)

Tier 2 - secrets that enable account takeover:

.aws/credentials
.ssh/id_rsa, .ssh/config
.docker/config.json (registry auth)
.kube/config (cluster access)
.terraform/terraform.tfstate (contains passwords in plaintext)

Tier 3 - information that shouldn't be public:

.vscode/settings.json (sometimes contains tokens)
.idea/ (JetBrains configs with database passwords)
*.sqlite, *.db (local databases with user data)
coverage/ (can reveal internal file paths)
.claude/memory/ (Claude's notes about your project)

GitGuardian's 2026 report: 29 million secrets leaked on GitHub last year. 64% of credentials leaked in 2022 were still valid in 2026. Nobody revoked them.

The .gitignore rules nobody adds

These are the lines missing from almost every project:

# AI tool configs (NEW in 2025-2026)
.claude/
.cursor/
.aider*
.continue/
.cody/
.codex/

Before AI coding tools, you didn't need these. Now every project has at least one AI config directory with potential secrets. Most developers add the tool, use it for weeks, and never think to update .gitignore.

# Environment files (all variants)
.env
.env.*
!.env.example

The !.env.example exception is important. You want to commit the template (with dummy values) so new team members know which variables to set. You don't want to commit the actual values.

# Cloud credentials
.aws/
.azure/
.gcloud/
.terraform/terraform.tfstate
.terraform/terraform.tfstate.backup

Terraform state files deserve special attention. They store your infrastructure state in plaintext, including database passwords and API keys. I've seen production database credentials sitting in public GitHub repos inside .tfstate files.

The trap: .gitignore doesn't fix files already committed

This is the mistake that kills people. You add .env to .gitignore after you've already committed it. The file is still in your git history. Anyone who clones your repo can run git log --all -- .env and see every version.

Adding to .gitignore only prevents future commits. To actually remove a file from history:

# Remove from tracking but keep the local file
git rm --cached .env
git commit -m "chore: remove .env from tracking"

# To remove from entire git history (nuclear option)
# Install BFG Repo-Cleaner first
bfg --delete-files .env
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

After cleaning history, rotate every credential that was ever in that file. If your Stripe key was in git history for 3 months, assume it's been scraped. GitGuardian found that bots scan public repos within minutes of a push.

The Anthropic lesson: .npmignore matters too

.gitignore protects your git repository. But when you publish a package, npm/PyPI/RubyGems use different ignore files:

npm  → .npmignore (or "files" field in package.json)
PyPI → MANIFEST.in or pyproject.toml excludes
Ruby → .gemspec files list

Anthropic's leak happened because they had no .npmignore entry for source maps. Their .gitignore was probably fine. The npm package included everything.

If you publish packages, always run a dry run before publishing:

# npm - see what gets packaged
npm pack --dry-run

# Python - check your sdist
python -m build --sdist
tar -tzf dist/*.tar.gz | grep -E '\.env|\.claude|secret'

The full .gitignore (copy-paste ready)

Node.js / TypeScript

# Dependencies
node_modules/
.pnp.*

# Build
dist/
build/
.next/
out/

# Environment
.env
.env.*
!.env.example

# AI tools
.claude/
.cursor/
.aider*
.continue/
.cody/
.codex/

# Secrets & credentials
*.pem
*.key
*.p12
*.pfx
credentials.json
service-account*.json
.npmrc
.aws/
.ssh/
.docker/config.json

# IDE
.vscode/settings.json
.idea/

# OS
.DS_Store
Thumbs.db

# Logs & coverage
*.log
coverage/
.nyc_output/

# Terraform
.terraform/
*.tfstate
*.tfstate.backup

Python

Python
# Virtual environments
venv/
.venv/
env/

# Build
__pycache__/
*.py[cod]
*.egg-info/
dist/
build/

# Environment
.env
.env.*
!.env.example

# AI tools
.claude/
.cursor/
.aider*
.continue/
.cody/

# Secrets & credentials
*.pem
*.key
credentials.json
service-account*.json
.pypirc
.aws/
.ssh/

# IDE
.vscode/settings.json
.idea/

# OS
.DS_Store

# Jupyter
.ipynb_checkpoints/

# Logs & coverage
*.log
htmlcov/
.coverage

# Terraform
.terraform/
*.tfstate
*.tfstate.backup

GO

Go
# Binary
bin/
*.exe

# Environment
.env
.env.*
!.env.example

# AI tools
.claude/
.cursor/
.aider*
.continue/

# Secrets
*.pem
*.key
credentials.json
service-account*.json
.aws/
.ssh/

# IDE
.vscode/settings.json
.idea/

# OS
.DS_Store

# Vendor (optional)
# vendor/

# Coverage
coverage.out
*.prof

The checklist

Before your next push:

1. Is .claude/ in your .gitignore?
2. Are ALL .env variants covered (.env, .env.*, !.env.example)?
3. Have you checked git history for previously committed secrets?
4. If you publish packages: do you have .npmignore / MANIFEST.in?
5. Have you run npm pack --dry-run to see what actually ships?
6. Are cloud credential directories (.aws/, .ssh/) excluded?
7. Is .terraform/terraform.tfstate excluded?

Anthropic forgot one line and leaked 512,000 lines of source code. Your .gitignore is the cheapest security investment you'll ever make. Update it today.

I share daily notes on AI, finance, and vibe coding in my Telegram channel: https://t.me/zodchixquant

Thanks for reading🙏🏼