Unit II · Saving and undoing
What never goes in the repository
A repository remembers everything, including the key you committed by mistake and deleted a minute later. Keep secrets and generated files out from the start.
.gitignore
A .gitignore file lists paths Git should not track: the .env file with your keys, installed packages such as node_modules/ or vendor/, build output, logs and local databases. Add it before your first commit, not after.
A pushed secret is a leaked secret
Deleting a key in a new commit does not remove it from the history, and a rewritten history can still survive in other people's clones and in forks. GitHub's documentation says that when the leaked data is a secret, as a first step you revoke or rotate it: make a new one at the provider and disable the old one. Once the old key no longer works, rewriting the history may not even be needed.
Why generated files stay out
Installed packages and build output can be recreated from your manifest, lock file and source. Committing them bloats the repository and hides real changes among thousands of generated lines.
Words to know
- .gitignore
- the list of paths Git ignores
- Secret
- any value that grants access: keys, passwords, tokens
- Rotate
- replace a secret with a new one and disable the old one
- History
- every commit ever made in the repository
Sources
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.