RedactBar

How to find unprotected and un-gitignored .env files on Mac

Audit your development directories to catch uncommitted secrets before they leak to GitHub.

1. The Risk: The Accidental `git add .`

New projects often begin by copying an existing .env file or downloading staging credentials. If a .gitignore file has not been initialized or omits .env*, a single git add . stages live database passwords and API keys.

2. Terminal Command: Find All .env Files Not in .gitignore

You can verify which .env files are tracked or unignored using Git's check-ignore plumbing command:

find ~/Projects -name ".env*" -not -path "*/node_modules/*" | while read -r f; do
  dir=$(dirname "$f")
  if [ -d "$dir/.git" ]; then
    if ! git -C "$dir" check-ignore -q "$f"; then
      echo "⚠️ UNPROTECTED: $f"
    fi
  fi
done

3. Add Global Gitignore Protection

Prevent this across all repositories by adding .env to your global Git ignore list:

git config --global core.excludesfile ~/.gitignore_global
echo ".env*" >> ~/.gitignore_global
echo "*.local.env" >> ~/.gitignore_global

Related Guides