My API key is visible in the repository

Deleting the file does not remove it. This page explains why, and what to do in what order.

Seen in apps built with Lovable.

What is actually happening

A `.gitignore` only stops git from picking up files it is not already tracking. If `.env` was committed once, before the ignore rule existed, git keeps tracking it and the rule has no effect at all.

That is why our sample is what it is: all 26 projects had the ignore file. The key went in first, the rule came later.

Deleting the file now removes it from the current version and from nothing else. Every previous commit still contains it, and on a public repository every previous commit is readable by anyone.

Confirm it in one command

git log --all --full-history -- .env

Any output at all means the file is in the history. An empty result means it never was.

Fixing it yourself

• Rotate the key first. Not after cleaning history — first. Until it is rotated, the exposure is live and everything else is housekeeping.
• Then `git rm --cached .env` and commit, so it stops being tracked going forward.
• Then decide about history. Rewriting it is possible but it changes every commit hash, which breaks anyone else's clone.

Where it stops being a small job

When you cannot tell which of the keys in that file actually matter. A browser app is handed some keys by design and they are safe; others were never meant to leave your machine. Telling one from the other requires knowing what is protecting the thing at the far end, and that is not visible in the repository at all.