A .env file exported with the code puts every key in it where anyone with access to the repository can read them, and deleting the file doesn't remove them from git history.
What you see
The repository has a .env file, or keys written straight into the code (sk_live_…, re_…, a database URL with its password).
Why it happens
Some tools export the .env with the project, and the .gitignore Vite starts with doesn't cover .env files. Once committed, a key stays in the history even after the file is deleted.
How to fix it
- Revoke and replace every key the file held, in each provider's dashboard.
- Remove the file from git (
git rm --cached .env) and add.env*to.gitignore(with!.env.exampleif you keep one). - Set the new values at the host instead.
Or ask your AI tool to fix it
Paste this into Lovable, Bolt, v0, Replit or Cursor:
Remove .env from the repository (keep it locally), add .env* to .gitignore with !.env.example, create a .env.example listing every variable with no values, and make sure no key or password is written in the code. Then list every key I need to revoke and replace.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/env-file-committed-to-github. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.
Top comments (0)