3.3. Best Practices

Security Best Practices

NEVER commit API keys, passwords, private keys, or other credentials.

Recommendation: maintain a global ignore file as a personal safety net. Use it for recurring sensitive or local file patterns across your repositories.

Create the file, register it with Git, and then edit it to add your patterns:

mkdir -p ~/.config/git
touch ~/.config/git/ignore
git config --global core.excludesFile ~/.config/git/ignore

Use global rules for personal protection; commit project-specific rules in the repository’s .gitignore.

✅ DO

• Maintain a curated global ignore file for recurring personal exclusions.

• Commit project-specific .gitignore files and review their changes in PRs.

• Keep patterns organised and commented; test them with git check-ignore -v.

• Commit safe configuration templates such as .env.example.

• Inspect staged changes with git diff --cached before committing.

• Use environment variables or secret management services instead of hardcoding credentials.

❌ DON’T

• Treat your global ignore file as a substitute for a tracked project .gitignore.

• Expect ignore rules to hide or remove secrets that are already tracked.

• Blindly bypass ignore rules with git add -f.

• Ignore source code or safe configuration templates.

• Use broad patterns that hide important files; globally ignoring formats such as .csv or .json may hide legitimate inputs or test fixtures.

• Forget to update project rules when adding new file types.