{
  "id": 16064146,
  "title": "AI wrote your .env into a commit? What GitHub push protection catches, and why `.gitignore` alone won't save you",
  "url": "https://urgent.news/2026/10/22/ai-wrote-your-env-into-a-commit-what-github-push-protection-catches",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-22T15:35:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/penloom_studio_829b7817d3/ai-wrote-your-env-into-a-commit-what-github-push-protection-catches-and-why-gitignore-alone-9i9"
  },
  "original_language": "en",
  "account": "An AI-generated .env file containing a fake API key was committed to a repository. Despite adding the .env file to the .gitignore and removing it from the tracked files, the key remained in the commit history. This is because git log --all -- .env still listed the original commit where the key was added.\n\nGitHub offers push protection by default, which prevents secrets from being pushed to public repositories. The protection scans for pushes from various sources like the command line, commits made in the GitHub UI, file uploads, and REST API requests. If a push is blocked, a message explaining why appears. The solution is to remove the secret and push again.\n\nPush protection for repositories requires the GitHub Secret Protection feature to be enabled, which is off by default. Users can check their own setting by going to their profile picture, settings, and code security under the User section. However, push protection only supports certain secret types and does not provide 100% protection, especially for private repositories without user-level protection.\n\nIf a real API key were pushed to a commit, it should be treated as exposed and replaced with a new key from the provider. Deleting the file alone is not sufficient to secure the key.",
  "summary": "Result first: I committed a fake API key in a .env file, then \"fixed\" it the way most people do: add .env to .gitignore and run git rm --cached .env . The file stopped being tracked, but the key was still in history. git log --all -- .env still lists the commit that added it. Anyone who can clone the repository can read that commit. echo '.env' >> .gitignore git rm --cached .env git commit -m…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}