Dev.to
6/15/2026
Audit your Git history for
Original: Your .env file is probably already in your Git history. The 15-minute audit (and the 5 habits that stop new leaks for good).
Short summary
Leaked API keys hidden in git history are the most preventable production incident in indie SaaS—€240 in unauthorized charges within 48 hours is typical. Use gitleaks or trufflehog to audit repos, check GitHub secret scanning, and rotate compromised keys immediately. Prevent future leaks with five habits: set up .gitignore first, add pre-commit hooks, instruct AI tools to read secrets from environment variables, maintain a secrets-rotation checklist, and explicitly revoke old keys when rotating.
- •Leaked API keys in git history cause the #1 preventable incident for indie SaaS (real case: €240 charged in 48 hours)
- •Audit with gitleaks/trufflehog; check GitHub secret scanning; immediately rotate and revoke compromised keys
- •Establish five habits: .gitignore setup, pre-commit hooks, AI tool prompts, secrets tracking, explicit revocation
Generated with AI, which can make mistakes.
Is this a good recommendation for you?
