How to stop .env files from leaking into git history

A committed .env is one of the fastest ways to expose secrets to everyone with repo access — and git keeps them forever. This guide covers diffing, rotating, and auditing environment variables so you can stop the leak and keep the surface small.

Last updated: June 2026 · ~6 min read

Why .env leaks keep happening

Most teams know the rule: do not commit .env. Yet it happens constantly. A new dev runs the wrong command, a linter rule is misconfigured, or someone copies a file into a build artifact that gets checked in. The problem is rarely intent — it is friction. The fixes below are designed to be easy enough that people actually do them.

The failure modes look familiar:

• Copy-paste into a config file — a .env gets pasted into config.js and config.js goes into git.
• Build artifacts — a bundler inlines environment variables into a committed bundle.
• History is scary — once a secret is in git, nobody wants to touch it, so it sits there for years.
• No rotation cadence — even if you know a key leaked, rotating it means updating five files and hoping nothing breaks.

Step 0 — Install Envault

Envault is published to the project's own package index (it is not on public PyPI yet), so point pip at the index — or install straight from source:

# From the project package index (recommended)
pip install --index-url https://coding-dev-tools.github.io/pypi-index/simple/ rh-envault

# Or directly from source (always tracks the latest code)
pip install git+https://github.com/Coding-Dev-Tools/envault.git

Requires Python 3.10+ — pure Python, no compiled wheels. The installed CLI entry point is rh-envault.

Step 1 — Diff before merge

The fastest way to catch a leak is to compare environments in CI before the code ships. Envault diffs two environments and highlights missing, added, or changed values — secrets are masked in the output.

# Compare dev vs prod
rh-envault diff dev prod

# Fail the CI build if prod has keys staging does not
rh-envault diff staging prod --fail-on-missing

# Compare two .env files directly
rh-envault diff-files .env.dev .env.prod

Put the diff in a pre-merge hook or your CI pipeline. A red build is cheaper than rotating secrets after a release.

Step 2 — Rotate as part of deploy

If a secret has leaked, rotation is the fix — not deletion. Envault infers the secret type and generates a value that fits the slot:

# Rotate a single secret
rh-envault rotate DB_PASSWORD

# Rotate with a dry run so you can preview the value
rh-envault rotate API_KEY --dry-run --show

# Rotate everything in an environment
rh-envault rotate-all --env prod

Rotate in the branch, land it, then sync to prod in the same deploy. That keeps the new value in one place instead of scattered across environments.

Step 3 — Keep plaintext surface small

The config file is Git-friendly. The secrets are not. Envault stores configuration in a .envault.yml file you can commit, while secrets live outside version control. Every rotate, sync, and diff is logged to .envault-audit.log so you have a timestamped record instead of relying on memory.

# Inspect recent rotations
rh-envault audit --limit 20

# Filter by key
rh-envault audit --key DB_PASSWORD

# Filter by action
rh-envault audit --action rotate

When something goes sideways, you have a log to read instead of a Slack thread from six months ago.

Step 4 — CI runner as pass-through, not a vault

The pattern that keeps recreating leaks is echo > .env inside a job. Instead, let Envault serve the secrets over HTTP locally and have the runner fetch them at runtime:

# Start the secrets API on localhost
rh-envault serve --api-key $ENVAULT_API_KEY

# Fetch a single secret in a job
curl -H "Authorization: Bearer $ENVAULT_API_KEY" \
  http://localhost:8080/secrets/DB_PASSWORD

For MCP server sidecars and AI agent runtimes, Envault exposes a GET /secrets and GET /secrets/{key} endpoint with Bearer token auth. No plaintext secrets are written into the workflow file or uploaded as artifacts.

What you actually get

Source: the Envault README pricing & per-tier feature table. A Suite plan ($49/mo) covers all 11 Revenue Holdings CLI tools; Team ($79/mo) adds a shared config store. Annual billing saves 20%.

FAQ

Envault is part of Revenue Holdings — a suite of developer CLI tools. See also How to rotate API keys safely in CI/CD for API-key-specific rotation guidance.