Keeping .env secrets out of git

I committed my .env by mistake and our database password is now sitting in the commit history forever.

BeginnerRead 4 minDoing: under an hour5 steps

▶ Start

What you'll have at the end

A .env file loaded with dotenv, listed in .gitignore, with a checked-in .env.example teammates copy instead

Before you start

You need

A project whose real secret values sit in a .env file that a past commit already added to the repository, with something in the running app that already reads those same values by name.

Not covered

Rewriting the repository's history so the file disappears from old commits, and setting these same values on whatever host eventually runs the app in production.

Leans on

5 steps

Where to go next

Load secrets from a .env file without installing anything

the secret has not been committed yet and you want it loaded with no extra package installed, rather than closing an exposure that already happened.

Checked 25 Aug 2026

Part of the Express.js cookbook