Checks · SEC-006

SEC-006 · .env file committed

Why it matters

A committed .env file usually holds live keys and database passwords.

How we detect it

A file named .env, or a close variant, is present in the tree.

How we fix it

Remove it from the tree, add it to .gitignore, and rotate every value that was in it.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret