Fixes · Security holes

.env file and API keys committed to GitHub

A .env file exported with the code puts every key in it where anyone with access to the repository can read them, and deleting the file doesn't remove them from git history.

Most common in apps built with Bolt, Lovable.

What you see

The repository has a .env file, or keys written straight into the code (sk_live_…, re_…, a database URL with its password).

Why it happens

Some tools export the .env with the project, and the .gitignore Vite starts with doesn't cover .env files. Once committed, a key stays in the history even after the file is deleted.

How to fix it

  1. Revoke and replace every key the file held, in each provider's dashboard.
  2. Remove the file from git (git rm --cached .env) and add .env* to .gitignore (with !.env.example if you keep one).
  3. Set the new values at the host instead.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor, and let it make the change.

Remove .env from the repository (keep it locally), add .env* to .gitignore with !.env.example, create a .env.example listing every variable with no values, and make sure no key or password is written in the code. Then list every key I need to revoke and replace.

Don't change what the app does.
Never put a secret key or password in the code: read it from an environment variable.
If a step has to be done outside the code, like revoking a key in a provider's dashboard, list it for me at the end instead of skipping it.

How Launchpad helps

The launch check finds committed keys by their shape and reports the file and line, never the value. Launchpad keeps every key out of the repository: they're set at the host, per environment.

Check your app for this, freeJoin the waitlist

Related