.gitignore Everything by Default
A developer proposes a 'deny-by-default' strategy for Git repositories by using a restrictive .gitignore file that only tracks explicitly allowed files. This approach aims to prevent the accidental inclusion of sensitive environment variables or unnecessary configuration files.
Why it matters
It offers a practical security and hygiene improvement for software development workflows to prevent data leaks.
I think we’ve all been there. You’re working on a project, making commits, and then suddenly realize you’ve been committing .DS_Store files, node_modules, IDE configuration files, or other junk (CLAUDE.md for example) that shouldn’t be in your repository. Or even worse - environment variables. Then comes the embarrassing cleanup: adding these files to .gitignore, removing them from the repository history, and hoping that no one has noticed.
What if we flipped this approach entirely? Instead of allowing everything by default and selectively ignoring files, what if we ignored everything by default and only allowed specific files?
Here’s what this could look like in practice for a simple Go project:
* !.gitignore !*.go !README.md !go.mod !go.sum This .gitignore file does exactly that:
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in