mfogliatto / mfogliatto/ReferenceCop
[Security] .gitignore missing .env exclusion
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
## Description
The `.gitignore` file does not exclude `.env` files. If a developer adds environment variables (API keys, tokens, secrets) in a `.env` file during local development, they could accidentally be committed to the repository.
## Affected File
`.gitignore`
## Severity
**Low** — No `.env` files currently exist in the repo, but this is a preventive measure.
## Suggested Fix
Add the following to `.gitignore`:
```
# Environment files
.env
.env.*
*.env
```
## Context
The `.mcp.json` file already correctly references `GITHUB_PERSONAL_ACCESS_TOKEN` via environment variable interpolation (`${...}`), but without the gitignore exclusion, a `.env` file used by other tooling could slip through.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the repository's .gitignore file and compare its existing patterns with the requested environment-file exclusions. Add the three listed patterns, then verify that .env, .env.* and *.env are ignored while reviewing the diff to ensure only .gitignore changed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100