.env

A hidden settings file that often holds passwords, API keys, and database links for your app.

Why this matters: If this file goes public, anyone on the internet could steal your keys and access your accounts or data.

.env.local

A local-only version of your settings file — common in Next.js and React apps.

Why this matters: It usually contains the same secrets as .env, just for your computer. Uploading it exposes those secrets too.

API keys

Long codes that let your app talk to services like OpenAI, Stripe, or email providers. Sometimes they live in .env, sometimes hardcoded in files.

Why this matters: A leaked API key can let strangers use your paid services — and you get the bill.

Passwords

Any real login passwords or secret tokens written directly in your code or config files.

Why this matters: Once on GitHub, passwords are very hard to fully remove. Attackers scan public repos for them automatically.

node_modules/

A folder full of code libraries your app depends on. It can contain thousands of files and is recreated automatically.

Why this matters: It's huge, unnecessary to upload, and slows everything down. Your package.json file lists what's needed instead.

venv/

A Python virtual environment folder — a copy of Python tools used only on your computer.

Why this matters: Like node_modules, it's regenerated from your requirements file and shouldn't be shared.

__pycache__/

Temporary files Python creates automatically when you run your app.

Why this matters: They're not part of your actual project and just add clutter. No one needs them on GitHub.

.DS_Store

A small file macOS creates in every folder to remember icon positions.

Why this matters: It's not harmful, but it's personal to your computer and has no place in your app's code repository.

*.sqlite3

A local database file where your app might store user data during development.

Why this matters: It can contain real user emails, passwords, or test data that shouldn't be public.

*.db

Another common extension for local database files.

Why this matters: Same risk as .sqlite3 — private data could end up visible to the world.

Private certificates

Special security files (often ending in .pem or .key) that prove your app's identity.

Why this matters: If someone gets your private certificate, they can impersonate your app or decrypt secure traffic.

Backup files

Old copies of your project like .bak, .backup, or duplicate folders you made just in case.

Why this matters: Backups often contain outdated secrets or messy experiments you'd rather keep private.