.gitignore. What Not to Track

Not everything should go into Git. Secrets, dependencies, and build artifacts should be excluded using .gitignore.

Why .gitignore matters

• Never commit passwords, API keys, or database credentials
• Don't commit node_modules/. It's huge and auto-generated
• Don't commit OS files like .DS_Store (macOS) or Thumbs.db (Windows)

Example .gitignore for a web project

# Environment & secrets
.env
config.local.php
*.key
*.pem

# Dependencies (always regeneratable)
node_modules/
vendor/        # PHP composer packages

# Build output
/dist
/build
*.min.js.map

# OS / Editor files
.DS_Store
Thumbs.db
.vscode/settings.json
.idea/

# Logs
*.log
error_log

GitHub's gitignore templates

When creating a new repo on GitHub, you can choose a language-specific .gitignore template that covers the most common files to exclude.

If you accidentally committed a secret

# Remove file from tracking but keep it locally
git rm --cached config.php

# Then add to .gitignore and commit
# IMPORTANT: also rotate the exposed secret immediately!