gitignore: never track .env.bak* backups (defuse staged live secrets)

39d07a245661a36eac90f8253cfd192b464a7bef · 2026-09-14 12:53:53 -0700 · Steve Abrams

Two .env.bak* files (containing a live sk_live Stripe key, DATABASE_URL,
and a Google API key) had been staged for commit because .gitignore only
covered .env / .env.local. Unstaged via git rm --cached and added
.env.bak* / .env.*.bak so backups can't be committed again. Files remain
on disk. Exposed keys should be rotated separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore

Diff

commit 39d07a245661a36eac90f8253cfd192b464a7bef
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Sep 14 12:53:53 2026 -0700

    gitignore: never track .env.bak* backups (defuse staged live secrets)
    
    Two .env.bak* files (containing a live sk_live Stripe key, DATABASE_URL,
    and a Google API key) had been staged for commit because .gitignore only
    covered .env / .env.local. Unstaged via git rm --cached and added
    .env.bak* / .env.*.bak so backups can't be committed again. Files remain
    on disk. Exposed keys should be rotated separately.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitignore | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitignore b/.gitignore
index bbc9717..77fc57b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,7 @@ tmp/
 # Standing-rule additions (2026-05-07)
 build/
 .next/
+
+# backup env files (never commit secrets)
+.env.bak*
+.env.*.bak

← 69fd19d chore: macstudio3 migration — reconcile from mac2 + repoint · back to Professional Directory · (newest)