.gitignore and what never goes in a repo

What stays out

A repository holds what someone needs to rebuild the app, and nothing that one machine made or that nobody else should see.

• Dependencies: node_modules/. They're large, and npm install rebuilds them from package.json.
• Build output: dist/, build/, .next/. The build makes these again.
• Local configuration and secrets: .env, which holds your real values (lesson 2.4.2). Commit .env.example with placeholders instead.
• Local databases: files like the app.db from lesson 2.3.5. They hold your test data, and the migrations rebuild the schema.
• Logs and OS files: *.log, .DS_Store (macOS), Thumbs.db (Windows).

A .gitignore for a Node app

Put a file called .gitignore in the repository's top folder, and commit it:

# Dependencies
node_modules/

# Build output
dist/
build/

# Local configuration and secrets
.env

# Local databases
*.db

# Logs and OS files
*.log
.DS_Store
Thumbs.db

A trailing / matches a folder, * matches any characters, and # starts a comment. Run git status afterwards: the ignored files should no longer be listed.

Before the first commit of any project, run git status and read the list. Every file on it is about to become part of the history. If you see a folder of dependencies, a database file or a .env, add a rule first.

Starting a project in another language? Search for a .gitignore template for it (GitHub keeps a collection) and trim it to what you use.

Ignored isn't removed

.gitignore only affects files Git isn't tracking yet. If .env was committed last week, adding it to .gitignore today changes nothing: Git keeps tracking it and shows every edit.

To stop tracking it without deleting your copy:

git rm --cached .env
git commit -m "Stop tracking .env"

That removes it from the next commit, not from the history. Every earlier commit still contains it, and anyone with a copy of the repository can read it. If it held a secret, treat the secret as leaked: rotate it first, then clean the history, as you'll do in lesson 2.6.3.