Not every file in a project folder belongs in Git — installed dependencies, build output, and secrets should never be tracked. A .gitignore file tells Git which files or folders to ignore entirely.
# .gitignore
node_modules/
.env
*.log
dist/
.DS_Store| Pattern | Matches |
|---|---|
| node_modules/ | A specific folder, anywhere in the project |
| *.log | Every file ending in .log |
| .env | A specific filename |
| /build | Only a build folder at the project root, not one nested deeper |
| !important.log | An exception — un-ignores one specific file that would otherwise match a pattern above it |
| Category | Example |
|---|---|
| Dependencies | node_modules/, vendor/ — reinstalled from package.json/composer.json instead |
| Secrets | .env — from the earlier PHP/Node lessons on environment variables |
| Build output | dist/, build/ — regenerated from source, not source itself |
| Editor/OS files | .DS_Store, .vscode/, Thumbs.db |
| Logs and caches | *.log, .cache/ |
Adding a pattern to .gitignore only affects files Git doesn't already know about — a file already committed keeps being tracked until explicitly removed.
# Stop tracking a file, but keep it on disk
git rm --cached .env
git commit -m "Stop tracking .env"A leaked secret needs rotating, not just ignoring
If a secret (an API key, a password) was ever committed, adding it to .gitignore afterward does NOT remove it from history — it's still recoverable from any earlier commit. Rotating the exposed secret immediately is the actual fix; removing it from history entirely is a separate, more advanced operation.