.gitignore

A .gitignore file is a small file with an outsized impact on security. It's one of the first things to set up in any vibe-coded project.

What to Ignore

Always Ignore

• Environment files — .env, .env.local, .env.production
• Dependencies — node_modules/, vendor/, venv/
• Build output — dist/, build/, .next/
• IDE files — .vscode/settings.json, .idea/
• OS files — .DS_Store, Thumbs.db

Never Ignore

• Source code — Your actual application files
• Configuration — package.json, tsconfig.json
• Lock files — package-lock.json, bun.lockb
• Documentation — README, license files

The Security Risk

Exposing secrets in version control is one of the most common security mistakes:

1. API keys get committed accidentally
2. Keys end up on public GitHub repositories
3. Bots scan GitHub for exposed keys within minutes
4. Your accounts get compromised

A .gitignore prevents this entirely.

Setting Up .gitignore

Most AI tools generate a .gitignore when scaffolding a project. Always verify it includes:

1. Environment and secret files
2. Dependency directories
3. Build artifacts
4. System-specific files

If AI doesn't generate one, ask: "Create a .gitignore for this project that excludes secrets, dependencies, and build output."