This is my file directory structure
project
How can I hide credentials in the .env file when I push to github? I know that you have to use .gitignore but how would that work since my .env is not in the root directory?
UPDATE
I tried doing what the response said but the .env file still did not disappear in my repo.
Here is what the .gitignore file reads:
.env
.idea
**/node_modules
data
yarn.lock
You can just add .env to .gitignore, then git add .gitignore followed by git commit. This will ignore .env in all subdirectories from future git operations, so the .env file will not be pushed at all to GitHub.
The .gitignore file specifies patterns of a file or directory name, not the explicit path relative to the location of .gitignore in the directory tree. This means that you don't need to specify project/client/.env etc separately.
So, just add this to your .gitignore:
.env
If you already accidentally pushed your .env file and it contained sensitive credentials, revoke those credentials immediately and treat them as if bots have already scraped them, and follow the instructions here: Removing sensitive data from a repository
As a side-note, if your application requires environmental variables to work, it's customary to document them in your README. I also often see a file named like .env.sample or something similar, which is a boilerplate for each developer's own .env file. This file usually just contains the keys without the values, so other developers know which variables they need to set up.