Repository hygiene · rule repo-committed-credential-file
Credential files committed to a data repository
A Metacenta review checks this under the rule No credential-shaped filenames are tracked. Everything below applies whether or not you ever commission one.
What this rule checks
This rule flags tracked files whose names are normally used for credentials. They include .env, .env.production, id_rsa, .pfx and .p12 files, credentials.json, service-account*.json, secrets.yml and terraform.tfvars. Names ending .example, .template, .sample or .dist pass. So do .env.test and anything under a tests/, fixtures/ or examples/ folder. A .pem named as a certificate, such as fullchain.pem, passes too.
Why it matters
If a tracked file holds a real secret, it is in every clone and in the full history. Deleting the file does not revoke it; only rotating the credential does. Other .pem files, .npmrc and .pypirc are often harmless, so we rate those lower than a name that nearly always holds a secret.
How to fix it
Check the tracked credential-shaped files, and rotate anything live. Open each named file. If it holds a live secret, rotate the credential first, then purge the path from history and add the name to .gitignore. A certificate or a registry-only .npmrc can stay.
When it is fine to leave
A file that holds no secret despite its name, such as a public certificate or an .npmrc with only a registry address. The same goes for a dummy key a test suite uses outside the folders we skip. Tell us which applies, and the finding comes out of your report.
What we need to check it
Read-only access to the repository. We read the file list only, never contents, so a finding means a file needs opening, not that a secret is confirmed. If the host truncated the listing, we decline rather than report.