.gitignore and never committing secrets
Some files should never go into . The big ones:
- Secrets — (Application Programming Interface) keys, passwords, credentials. If you a to GitHub, treat it as leaked, even if you delete it later. The history remembers.
- Junk — temporary files, downloaded dependencies (like
node_modules), build output. Huge and pointless to track.
You control this with a file called .gitignore. You list patterns in it, and Git pretends those files don't exist. This is critical for vibe coders, because AI tools love to create config files with real keys in them, and it's easy to commit one by accident.
# A simple .gitignore file
.env
node_modules/
*.log
The .env line is the important one — that's where secrets usually live. Add .gitignore before your first commit, and make a habit of asking the AI: "is there anything in this commit that shouldn't be public?"