Description
The .gitignore file does not exclude .env files. If a developer adds environment variables (API keys, tokens, secrets) in a .env file during local development, they could accidentally be committed to the repository.
Affected File
.gitignore
Severity
Low — No .env files currently exist in the repo, but this is a preventive measure.
Suggested Fix
Add the following to .gitignore:
# Environment files
.env
.env.*
*.env
Context
The .mcp.json file already correctly references GITHUB_PERSONAL_ACCESS_TOKEN via environment variable interpolation (${...}), but without the gitignore exclusion, a .env file used by other tooling could slip through.
Description
The
.gitignorefile does not exclude.envfiles. If a developer adds environment variables (API keys, tokens, secrets) in a.envfile during local development, they could accidentally be committed to the repository.Affected File
.gitignoreSeverity
Low — No
.envfiles currently exist in the repo, but this is a preventive measure.Suggested Fix
Add the following to
.gitignore:Context
The
.mcp.jsonfile already correctly referencesGITHUB_PERSONAL_ACCESS_TOKENvia environment variable interpolation (${...}), but without the gitignore exclusion, a.envfile used by other tooling could slip through.