Frameworks such as Next.js and Vite read local files like .env and .env.local so you can run the app with your own keys. The file is convenient because it sits next to your code, which is exactly why it gets committed by accident.
Once a .env file is pushed, even briefly, the values live in git history and may be copied by automated scanners that watch public repositories. Deleting it in a later commit does not remove the old copy. AI tools can also create or overwrite these files, or paste their contents into a chat, without any warning.
Add .env and .env.local to .gitignore before your first commit, and commit only a template such as .env.example with fake values. Set production values in your host's dashboard. If a real file was ever committed, rotate every key inside it instead of relying on history cleanup.
.env
.env.local
.env.*.local