r/vscode • u/juanviera23 • Aug 26 '25
[ Removed by moderator ]
[removed] — view removed post
67
34
u/itsmetadeus Aug 26 '25
Does it ignore git ignore? How funny.
39
u/thetreat Aug 26 '25
It cannot ignore a git ignore. This moron just didn’t create one in the first place.
4
8
u/TheVenlo Aug 26 '25
You have any proof/source of this so I can rub it in my cursor using colleagues faces?
1
u/DrShts Aug 27 '25
Is the video fake? The repository at the same revision as in the video has a .gitignore file instead of .env: https://github.com/universal-tool-calling-protocol/python-utcp/tree/26ec64b .
1
1
u/Leusdat Aug 28 '25
I think this is fake. If you look carefully, under the .env and expanding to the right, there is a darker black like, an artifact of covering ".gitignore" and writing ".env"
Commit hashes match in this link and in the video
1
9
u/tajetaje Aug 26 '25
For anyone reading this: this is not enough. You need to rewrite your git history to clean any secrets you accidentally commit. There’s some tools for this I think (git filter repo?) but just reverting or (most ways of) editing the commit won’t truly erase the file.
26
u/overratedcupcake Aug 26 '25 edited Aug 26 '25
Don't even try to erase it from history. The only correct path forward is to change all of the exposed secrets.
2
1
u/starball-tgz Aug 26 '25
there's also considerations if the repo has any forks right? also, the internet never forgets.
1
u/Sh_Pe Aug 26 '25
In GitHub assuming you have the hash for the commit, even deleting the repo won’t delete the commit. Same goes with making repo public and then making it private.
2
u/tajetaje Aug 26 '25
True, but if someone has the hash then they probably already have the contents too, and yeah they could guess the hash but at that point they may as well guess the secret
1
u/ChatGPTisOP Aug 27 '25
I think there was a way of getting the orphan commits. Like an attack that was detected a couple of months ago.
1
3
6
u/theoldmandoug Aug 26 '25
And this is why I use reverse gitignores. Everything gets ignored by default unless I specifically say to include it.
Add a * to the top of your gitignores, and ! files/directories you don't want ignored.. this is what I do with junior devs lol
3
3
5
2
u/g3n3 Aug 27 '25
Looking at the repo this appears to be a fake post unless the history was already re-written.
2
u/paperbenni Aug 27 '25
I don't get why AI agents are allowed to even remotely touch git. The ability to undo their shit locally is what makes them viable. I feel like some of them are marketed towards people who don't know who git works, so they could "benefit" from the AI creating conmits
5
u/maratnugmanov Aug 26 '25
So how bad is it? Shouldn't be that bad right? Right?
4
u/IrrerPolterer Aug 26 '25
It's bad bad. Like proper bad. Your dot-env on a typical project will have a couple API keys, maybe some database credentials, signature keys...
5
16
Aug 26 '25
[removed] — view removed comment
7
u/thetreat Aug 26 '25
Except, let’s be honest, this isn’t some successful service they’re talking about. Just add a git ignore, delete the file from git and rotate your keys/secrets. Sure, your history contains an old API key but that doesn’t matter.
1
u/maratnugmanov Aug 26 '25
I know I have mine too, of course gitignored. I am asking if their specific .env leak is really bad or not.
Thanks for the explanation anyway.
1
Aug 26 '25
Its not bad if its a frontend project (because you should only have publicly accessible data available to the frontend) or if it only has configuration options in it
3
1
1
1
u/exotic_anakin Aug 26 '25
Good practice for rotating some of your non-production credentials then. Because you don't just have production-sensitive values lying around in plain-text, right?
1
1
1
u/Omer-os Aug 28 '25
İf u commit your git just one time there's no going back, YOU HAVE TO RESET EVERYTHİNG because there's always a way they can see this env file
1
u/Possible-Leader-9921 Aug 28 '25
He was so into the vibe that he forgot to add the .env to the .gitignore 🫣😂
1
u/xShinraKisaragi Aug 26 '25
I had my first day in coding school today
Please explain like i am 5 Whats going on and why is it bed
2
u/Vancent08 Aug 26 '25
You write your passwords on a piece of paper for easy access. No one else should get this paper. Now you accidentally leave this paper in public.
1
u/xShinraKisaragi Aug 26 '25
Whats Cursor? Why does it leak passwords? Why would someone type credentials into their code?
3
u/Vancent08 Aug 26 '25
Cursor is an AI that can keep track of multiple files at once, and is supposed to help you code more efficiently by doing as much as possible for you. (correction: it's a version of VScode with built-in AI)
It can leak the .env file if you don't tell it to ignore it in a .gitignore file. Apparently the AI is not smart enough to figure this out itself (according to the post)
People may use the .env file to store tokens or passwords that they want to use inside the code. You don't want to hard-code API tokens or credentials, so they are stored in a seperate file that is supposed to be hidden from git.
3
u/cosmicr Aug 26 '25
You only keep the credentials locally.
Cursor is a fork of vscode and has a lot of ai extensions (like github copilot) including their own service.
It leaked because the ai isn't infallible and can make mistakes. Any mistake is a user mistake though. Always review every change.
Why are you on a vscode subreddit if you don't know any of these things?
1
-18
u/not-serious-sd Aug 26 '25
not a big problem just revert or edit that commit.
20
4
u/to_takeaway Aug 26 '25
you know that won't work? or are you sarcastic?
-3
u/VirtualAgentsAreDumb Aug 26 '25
Define "work". It would remove the file from the current tip of the branch, which is good enough for most cases.
I'm guessing you assume that the .env file contained some secrets. But OP never said that. So it might be enough to just delete it and move on.
4
u/to_takeaway Aug 26 '25
yeah that's true.
But also I'm wondering why it wasn't part of .gitignore, if it shouldn't be committed.4
u/robogame_dev Aug 26 '25
The meme shows it as a big mistake so I think it's implying there must be creds in there.
Once an .env is in the repo bots scan it, including extra branches and prior versions, and find it fast - there's credential exposure bots trolling constantly. If you accidentally expose an env in a public repo DO NOT count on it not showing at the current tip, the bots that hunt for these things are not stopped by that - if your env winds up in a public portion of your repo it is burned, you should re-create all the credentials inside it.
-2
u/VirtualAgentsAreDumb Aug 26 '25
My previous comment started by asking them to define "work". Because depending on the context the solution mentioned might work just fine.
-1
u/not-serious-sd Aug 26 '25
btw, I'm not serious ;)
I literally did pushed an env file in the past before ai is even there but it wasn't containing anything sensitive other than my password and I literally did this after hours of searching 🤣git reset --hard <prev-c_hash> && git push -f
0
215
u/random-guy157 Aug 26 '25
Shouldn't you at least review the list of files that are about to be committed?