SH202: .env file committed or not ignored¶

Severity: high · Category: secrets · Applies to: all projects

Why it matters¶

Environment files usually hold database passwords and API keys. If git can track them, they end up in the repository and in every clone.

Add the file to .gitignore, then remove it from git with git rm --cached.

devshield fix can resolve this rule for the cases it can change safely. Preview it with devshield fix --dry-run --only SH202.

Skip it everywhere in devshield.yml:

ignore:
  - SH202

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH202