Full Stack JavaScript Developer

Not every file belongs in Git. Build artifacts, personal config, and especially secrets (passwords, API keys) should never be committed. A .gitignore file tells Git which files and folders to ignore completely.

Create a .gitignore

In your project root, create a file literally named .gitignore (note the leading dot):

# macOS system files
.DS_Store

# Editor settings (personal preference, not project code)
.vscode/

# Environment files with secrets — NEVER commit these
.env
.env.local

# Log files
*.log

# Dependency folders (we'll use these when we add JavaScript tooling)
node_modules/

Save it, then:

git add .gitignore
git commit -m "Add .gitignore"

From now on, Git won't track files matching these patterns.

How Patterns Work

Pattern	Matches
file.txt	That exact file anywhere in the repo
*.log	All files ending in .log
folder/	That entire directory
# comment	Ignored line (a comment)

Patterns are relative to where the .gitignore file lives. A .gitignore in the project root applies to the whole repo.

Verify It's Working

Create a test file Git should ignore:

echo "secret=api-key-12345" > .env
git status

.env should not appear in untracked files. Git is ignoring it.

Create a normal file:

echo "hello" > notes.txt
git status

notes.txt should appear as untracked — it's not in .gitignore.

Clean up the test files when done.

Already Tracked Files

.gitignore only affects untracked files. If you already committed .env before adding it to .gitignore, Git keeps tracking it. Fix that with:

git rm --cached .env
git commit -m "Stop tracking .env file"

--cached removes the file from Git's tracking but leaves it on your disk. Add .env to .gitignore first so it doesn't get re-added.

What to Ignore in Web Projects

A sensible starter .gitignore for HTML/CSS/JS projects:

# OS junk
.DS_Store
Thumbs.db

# Editor
.vscode/
*.swp

# Secrets
.env
.env.*
*.pem

# Logs and temp files
*.log
tmp/
dist/

# JavaScript (when you get there)
node_modules/
.next/

You'll find ready-made templates at github.com/github/gitignore for almost any project type.

The Golden Rule

If a file contains passwords, API keys, or private tokens — never commit it. Put it in .env, add .env to .gitignore, and load secrets through environment variables in your app code (we'll cover that in JavaScript lessons).

Once a secret is in Git history, consider it leaked. Removing it later is painful. Prevention with .gitignore is easy.