---
title: "Credential files committed to a data repository | Metacenta"
description: "Which tracked filenames look like credentials, which we leave alone, such as .env.example and test fixtures, and what to do when one holds a live secret."
url: "https://metacenta.com/rules/repo-committed-credential-file"
updated: "2026-10-14"
tokens: 628
---

Repository hygiene · rule repo-committed-credential-file

# Credential files committed to a data repository

A Metacenta review checks this under the rule **No credential-shaped filenames are tracked**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags tracked files whose names are normally used for credentials. They include `.env`, `.env.production`, `id_rsa`, `.pfx` and `.p12` files, `credentials.json`, `service-account*.json`, `secrets.yml` and `terraform.tfvars`. Names ending `.example`, `.template`, `.sample` or `.dist` pass. So do `.env.test` and anything under a `tests/`, `fixtures/` or `examples/` folder. A `.pem` named as a certificate, such as `fullchain.pem`, passes too.

## Why it matters

If a tracked file holds a real secret, it's in every clone and in the full history. Deleting the file doesn't revoke it; only rotating the credential does. Other `.pem` files, `.npmrc` and `.pypirc` are often harmless, so we rate those lower than a name that nearly always holds a secret.

## How to fix it

**Check the tracked credential-shaped files, and rotate anything live.** Open each named file. If it holds a live secret, rotate the credential first, then purge the path from history and add the name to `.gitignore`. A certificate or a registry-only `.npmrc` can stay.

## When it is fine to leave

A file that holds no secret despite its name, such as a public certificate or an `.npmrc` with only a registry address. The same goes for a dummy key a test suite uses outside the folders we skip. Tell us which applies, and the finding comes out of your report.

## What we need to check it

Read-only access to the repository. We read the file list only, never contents, so a finding means a file needs opening, not that a secret is confirmed. If the host truncated the listing, we decline rather than report.

[Ask about a review](https://metacenta.com/enquire?src=rule-repo-committed-credential-file&via=md)

## Related pages

- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [Data repository with no README](https://metacenta.com/rules/repo-no-readme)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)