This template is designed with security as a top priority, especially for public repositories. We've implemented multiple layers of protection to prevent accidental exposure of sensitive information.
.envfiles are automatically ignored by Git- Git hooks scan for and block any attempts to commit
.envfiles - Template file (
.env.example) is safe and contains no sensitive data - Loader script applies configuration without exposing sensitive data in repository
Our Git hooks scan for potentially sensitive patterns before allowing pushes:
- Email addresses (Gmail, Yahoo, work domains, etc.)
- SSH keys (RSA, Ed25519, OpenSSH private keys)
- GPG keys (PGP private/public keys)
- API tokens (GitHub, OpenAI, Slack, etc.)
- Common secrets (passwords, tokens, keys)
- Real names in Git configuration
- Explicit consent required for each configuration step
- Clear warnings about what information will be written
- Public repository detection with extra security prompts
- Option to skip any potentially sensitive configuration
- No automatic detection of sensitive information
- Placeholder values used by default
- Manual configuration required for all personal details
- Security warnings throughout the setup process
- ❌ Personal email addresses in public repositories
- ❌ SSH private keys or key fingerprints
- ❌ GPG keys or signing key IDs
- ❌ API tokens and access keys
- ❌ Internal hostnames or network information
- ❌ Real names that users want to keep private
- ❌ Committing
.envfiles with sensitive data - ❌ Auto-configuring without user consent
- ❌ Writing detected system information automatically
- ❌ Exposing work email addresses or internal domains
- Copy the template:
cp .env.example .env - Edit with your information:
nano .env - Apply configuration:
./load-env-config.sh - Review changes:
git diff(before committing)
- Run the wizard:
./auto-configure.sh - Approve each step individually
- Skip sensitive information for public repositories
- Review all changes before committing
- Edit configuration files directly
- Use placeholder values for public repositories
- Keep sensitive config in private files
- Use environment variables for secrets
- Git hooks scan all files before push
- Environment files are blocked from commits
- Sensitive patterns trigger warnings
- Public repository detection enables extra checks
- Always run
git diffbefore committing - Check for personal information in all files
- Verify placeholder values are still in place
- Review generated configuration files
- Stop pushing to the repository
- Remove sensitive data from files
- Rewrite Git history if already pushed:
git filter-branch --force --index-filter \ 'git rm --cached --ignore-unmatch path/to/sensitive/file' \ --prune-empty --tag-name-filter cat -- --all - Force push the cleaned history (if repository is yours)
- Rotate compromised credentials (keys, tokens, passwords)
- Enable Git hooks:
./setup-git-hooks.sh - Use environment files for sensitive data
- Review all changes before committing
- Keep
.envfiles local and never commit them
If you discover a security vulnerability in this template:
- DO NOT open a public issue
- Email security concerns to: [your-security-email@domain.com]
- Include detailed information about the vulnerability
- Wait for acknowledgment before public disclosure
We take security seriously and will respond promptly to verified security reports.
We regularly update security patterns and protections. To get the latest:
- Check for updates to the template repository
- Update Git hook patterns in
.githooks/pre-push - Review new security features in release notes
- Test security hooks with:
git push --dry-run
- ✅ Use environment files for all sensitive data
- ✅ Enable Git security hooks
- ✅ Review all changes before committing
- ✅ Use placeholder values in configuration
- ✅ Keep real credentials in private files
- ✅ Regularly audit repository contents
- ✅ Still use environment files for portability
- ✅ Enable security hooks as a safety net
- ✅ Document sensitive configuration clearly
- ✅ Limit repository access appropriately
- ✅ Consider encryption for highly sensitive data
- ✅ Rotate credentials regularly
- ✅ Use strong, unique passwords
- ✅ Enable 2FA on all accounts
- ✅ Keep software and dependencies updated
- ✅ Monitor for unauthorized access
- ✅ Follow principle of least privilege
Remember: Security is a shared responsibility. While this template provides strong protections, always review and understand what you're committing to public repositories.