🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Web & Software Development › Git Version Control for Web & Software Development › Lesson 11
TEC-WEB46-05 · Lesson 11 · 16 clock hours · lab

Repository Security: .gitignore, Sensitive Data, and SSH

Objective. Students configure a .gitignore file to exclude sensitive and build files, verify that tracked sensitive data can be removed from history using git filter-repo or BFG, and confirm SSH authentication is used for all remote operations.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Repository Security Matters

A Git repository stores every version of every file you have ever committed. That history is a powerful feature for development, but it becomes a serious liability the moment a secret — an API key, a database password, a private token — is accidentally committed. Even if you delete the file in a later commit, the secret remains readable in the older commits. Anyone who clones or forks the repository can retrieve it. This lesson teaches you three interlocking defenses: preventing secrets from entering the repository with `.gitignore`, removing secrets that have already been committed, and securing your connection to remote services with SSH keys.

The .gitignore File

A `.gitignore` file tells Git which files and directories to leave completely untracked. Git will never stage or commit a path that matches an active ignore rule, and it will not show those paths in `git status` output.

A well-structured `.gitignore` for a web project covers four categories:

The free tool at gitignore.io (also reachable as `toptal.com/developers/gitignore`) lets you type in your stack — for example `python,php,windows,macos,vscode` — and it generates a ready-to-use file. Always commit `.gitignore` to the repository so every collaborator shares the same rules.

Adding a path to `.gitignore` only prevents future tracking. If a file is already tracked, Git continues to track it even after you add the ignore rule. You must run `git rm --cached <file>` to untrack it without deleting it from your working directory.

Removing Secrets Already in History

If a secret has been committed — even once, even many commits ago — you must rewrite history to remove it. Two tools are widely used:

After running either tool, every affected commit gets a new SHA hash. You must force-push (`git push --force` or `git push --force-with-lease`) to replace the remote history. Coordinate with your team first — anyone who has cloned the repository must re-clone or carefully rebase, because their local history is now diverged.

Always revoke and rotate the exposed credential immediately, even before you finish cleaning the history. Assume the secret was seen the moment it was pushed.

To verify that a file is completely gone from all history, run:

```

git log --all --full-history -- .env

```

If the command returns no output, the file does not appear in any commit on any branch or tag.

SSH Authentication

Git supports two transport protocols for remote operations: HTTPS and SSH. HTTPS requires you to authenticate with a username and token (or password) on every operation unless you use a credential helper. SSH uses a public/private key pair: your private key stays on your machine; the matching public key is uploaded to GitHub (or another host). Once configured, SSH operations require no password entry and are not vulnerable to credential-harvesting attacks that target passwords typed into prompts.

Check your remote URL with:

```

git remote -v

```

An SSH remote looks like `git@github.com:username/repo.git`. An HTTPS remote looks like `https://github.com/username/repo.git`. You can switch a remote from HTTPS to SSH with `git remote set-url origin git@github.com:username/repo.git`.

Generate a new SSH key pair with:

```

ssh-keygen -t ed25519 -C "your_email@example.com"

```

The `ed25519` algorithm is the current best practice. Accept the default file location or specify one, and set a strong passphrase when prompted — the passphrase protects your private key if your machine is compromised.

Copy the contents of the `.pub` file (the public key) to GitHub → Settings → SSH and GPG keys → New SSH key. Never share the private key file.

Test the connection with:

```

ssh -T git@github.com

```

A successful response reads: `Hi username! You've successfully authenticated...`

After adding a new key, remove the old key from GitHub settings so it can no longer be used.

Safety Points

Key terms8

.gitignoreA plain-text configuration file that tells Git which file paths and patterns to leave untracked and unstaged.
git filter-repoA Python-based command-line tool used to rewrite Git history, for example to permanently remove a file or string from every commit.
force-pushA Git push that overwrites the remote branch history with local rewritten history, required after a history-rewriting operation.
SSH key pairA matched set of cryptographic keys — a private key kept on your machine and a public key uploaded to a service — used to authenticate Git operations without a password.
ed25519A modern elliptic-curve algorithm recommended for generating SSH key pairs because of its strong security and small key size.
git rm --cachedA Git command that removes a file from the index (stops tracking it) without deleting the file from the working directory.
Environment file (.env)A local configuration file that stores environment variables such as API keys and database credentials; it must never be committed to version control.
Credential rotationThe practice of immediately replacing an exposed secret — such as an API key or password — with a new one, rendering the old one useless.
In class: Given a repository that has accidentally committed a file named .env containing fake API keys and database credentials, students add .env to .gitignore, then use the git filter-repo tool (or BFG Repo-Cleaner) to purge the file from all history, and force-push the cleaned repository; they verify the file no longer appears in any commit with git log --all --full-history -- .env. · Build a comprehensive .gitignore for a Python/PHP web project using gitignore.io, covering OS files (Thumbs.db, .DS_Store), editor files (.vscode/, .idea/), language artifacts (__pycache__/, *.pyc, vendor/), and environment files (.env); commit the .gitignore and test that a newly created .env file is correctly ignored. · Audit the remote URL of their repository with git remote -v to confirm it uses the SSH format (git@github.com:...) rather than HTTPS, rotate their SSH key by generating a new pair with ssh-keygen, add the new public key to GitHub, and remove the old key from GitHub settings; test the new key with ssh -T git@github.com.
Materials: Git workstation, terminal, git-filter-repo (pypi.org/project/git-filter-repo), gitignore.io, GitHub settings page, lab log
Check: Instructor confirms .env is absent from all commits using git log --all check; .gitignore covers all required categories; SSH test passes with new key; lab log entry complete; 80% score on a 10-question security-scenario quiz.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security fundamentals / version control
1. A developer commits a `.env` file containing a real database password and then immediately adds `.env` to `.gitignore` and makes a follow-up commit. What is the correct statement about the password after these two steps?
Git operations / security verification
2. Which command verifies that a file named `.env` no longer appears in any commit on any branch after a history-rewriting operation?
Git operations
3. A student wants to stop tracking a file called `config.php` that is already committed, without deleting it from their working directory. Which command accomplishes this?
Security / SSH
4. Which SSH key algorithm is currently recommended when running `ssh-keygen` for GitHub authentication?
Security / SSH
5. After generating a new SSH key pair, a student runs `ssh -T git@github.com` and sees: `Hi jsmith! You've successfully authenticated, but GitHub does not provide shell access.` What does this output confirm?
Git configuration / security
6. A `.gitignore` file contains the entry `vendor/`. Which of the following is the most accurate description of the effect?
Git collaboration / security
7. A team member is about to force-push a history-rewritten branch to a shared remote. What is the most important step to take before executing the push?
Security / SSH / Git remote configuration
8. A student runs `git remote -v` and sees the following output: `origin https://github.com/jsmith/myapp.git (fetch)` What does this tell them, and what action should they take to follow security best practices for authentication?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →