Once pushed, assume it’s public.
Git remembers everything. A secret committed once stays in the history, even if you delete it in the next commit.
01
Ignore first
Add .env to .gitignore before your first commit, not after.
02
Check the diff
Scan every commit for keys, passwords and tokens before it goes.
03
Tell the agent
In CLAUDE.md: “Never read, print or commit .env.”
04
Turn on scanning
Enable GitHub's secret scanning and push protection on your repos.
Source: GitHub Docs ↗
Ignore first. Check always. Rotate if in doubt.