.gitignore and keeping secrets out
30 min · Beginner
Need help? Ask a tutor on WhatsApp (opens in a new tab)Showing steps for Windows. They are marked “On Windows” below.
A .gitignore file tells Git which files to leave alone: generated files, IDE settings, system files and files with passwords. Git then hides them from git status and git add ..
.gitignore: files Git should not track
.gitignore is a plain text file in the top folder of a repository. Each line is a pattern for files or folders that Git should not track, such as build output, IDE settings and secrets.
Priya's project now makes a build/ folder, her editor adds .idea/, and .env holds a database password. Now git status lists files she never wants to commit.
On Windows
The build made build/, IntelliJ IDEA or PyCharm added .idea/ and marks-report.iml, and .env holds a database password.
PS C:\Users\Priya\marks-report> git statusOn branch main Untracked files: (use "git add <file>..." to include in what will be committed) .env .idea/ build/ marks-report.iml nothing added to commit but untracked files present (use "git add" to track)
Ignore anything the computer can make again (build/ and *.log; for Java also out/ and *.class, for Python __pycache__/), anything personal to your computer (IDE and system files) and anything secret. Commit the .gitignore itself so the whole team ignores the same files.
Write a .gitignore
Create a file named exactly .gitignore (with the dot, no extension) in the top folder, next to marks.txt. Each line is one pattern; lines starting with # are comments.
Keep the blocks that fit your language and delete the rest. A Java project builds into out/, target/ and *.class; a Python project into __pycache__/, *.pyc and the .venv/ virtual environment.
On Windows
In VS Code use File → New File and save it as .gitignore. Notepad adds .txt unless you choose Save as type: All files.
Example 1 · The .gitignore file
# Generated filesbuild/dist/*.log# Javaout/target/*.class# Python__pycache__/*.pyc.venv/# IDE and editor files.idea/.vscode/*.iml# System files (macOS, Windows).DS_StoreThumbs.db# Secrets.env?? .gitignore
What this code does
- With this file saved,
git status -slists only.gitignoreitself:build/,.idea/, the.imlfile,.envand the system files are hidden. - Stage and commit it like any file:
git add .gitignore, thengit commit -m "chore: add .gitignore for build, IDE and secret files". - Delete the blocks you do not need: a Java project keeps the Java block, a Python project the Python block. Eclipse users also add
bin/,.classpath,.projectand.settings/.
Keep secrets out of Git
Secret is the word for any value that gives access to something: a password, an API key or a token. A committed secret can be read by anyone who has the repository, even from old commits.
Deleting a password in a new commit does not help: the old commit still has it. So never type a secret into code; read it from an environment variable (Java: System.getenv, Python: os.environ).
Example 2 · Read a password from an environment variable: Java
public class DbConfig { public static void main(String[] args) { String password = System.getenv("DB_PASSWORD"); if (password == null) { System.out.println("DB_PASSWORD is not set."); } else { System.out.println("Password loaded: " + password.length() + " characters"); } }}DB_PASSWORD is not set.
What this code does
System.getenv("DB_PASSWORD")returns the variable's value, ornullwhen it is not set. No password is written in the code.- The program prints only the length, never the password, so it cannot leak into a screenshot or a log.
Example 3 · Read a password from an environment variable: Python
import os
password = os.environ.get("DB_PASSWORD")if password is None: print("DB_PASSWORD is not set.")else: print(f"Password loaded: {len(password)} characters")DB_PASSWORD is not set.
What this code does
os.environ.get("DB_PASSWORD")returns the variable's value, orNonewhen it is not set. No password is written in the code.- Like the Java version, it prints only the length, never the password.
Example 4 · Set the variable for this window
Runs in: Your terminal
PS C:\Users\Priya\marks-report> $env:DB_PASSWORD = 'Sunrise@2026'PS C:\Users\Priya\marks-report> $env:DB_PASSWORD.LengthOutput12
What this code does
- In PowerShell,
$env:NAME = 'value'sets a variable for this window only; it is gone when you close it. - The password lives in the terminal, not in any file Git can see. A Java or Python program started from this window can now read it, as in the examples above.
Rule of thumb: passwords, API keys and tokens never go into a commit. Put local ones in .env and list .env in .gitignore.
Optional: pattern rules and git check-ignore
A pattern without / matches in every folder. git check-ignore -v <path> tells you which line of .gitignore matched a path; it prints nothing when no line matches.
*.log:*means any characters, so every file ending in.logbuild/: a folder namedbuildand everything inside it/notes.txt: a leading/means only at the top of the repository!logs/README.md:!makes an exception, so this file is tracked
On Windows
Check three paths in PowerShell. Each line shows the file, the line number and the pattern, then the path:
PS C:\Users\Priya\marks-report> git check-ignore -v build/marks-report.zip .env Thumbs.db.gitignore:2:build/ build/marks-report.zip .gitignore:26:.env .env .gitignore:23:Thumbs.db Thumbs.db
! line cannot bring back a file inside an ignored folder: logs/ plus !logs/README.md still ignores the README. Ignore the folder's contents instead: logs/*, then !logs/README.md.Optional: already committed, or already pushed
.gitignore only hides untracked files. Priya committed build/marks-report.zip before she had a .gitignore, so every rebuild still shows M build/marks-report.zip. git rm --cached stops tracking a file but keeps it on disk.
Example 5 · Stop tracking the build folder
Runs in: Your terminal
PS C:\Users\Priya\marks-report> git rm -r --cached buildPS C:\Users\Priya\marks-report> git commit -m "Stop tracking build output"PS C:\Users\Priya\marks-report> ls buildOutputrm 'build/marks-report.zip' [main f280dee] Stop tracking build output 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 build/marks-report.zip Directory: C:\Users\Priya\marks-report\build Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 19-10-2026 10:30 929 marks-report.zip
What this code does
git rm -r --cached buildstaged the removal ofbuild/marks-report.zipfrom the repository; the commit saved it.ls buildproves the file is still on disk. Only Git stopped tracking it.
Without --cached, git rm also deletes the file from your disk; -r is needed for a folder.
A secret that was already pushed counts as public. First change it (new password, or revoke the key and make a new one). Then move it into an environment variable or an ignored .env file, commit and push the fix.
Next step
Check your understanding
8 quick questions