A missing line in .gitignore is not a leak. But it is the first thing between a secret and a public history, so we wanted to know how often the basic lines are actually there.
On 2026-11-12 we took 100 active public AI and MCP repositories and counted. We did not judge, and we name no repository here or in any file we publish. Nothing was reported to anyone.
The page with every count, the method and the script: https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto
| Count | |
|---|---|
Have a .gitignore at the root |
97 / 100 |
Have an .env pattern in it |
76 / 100 |
Have a .claude /settings.local.json pattern in it |
59 / 100 |
| Have a key-file or secrets pattern in it | 26 / 100 |
Have a Dockerfile at the root |
30 / 100 |
...of those, have a .dockerignore |
28 / 30 |
...of those, keep .env out of the build context |
18 / 30 |
...of those, keep .git out of the build context |
21 / 30 |
Keep Claude Code settings in the repository ( .claude/ ) |
12 / 100 |
| ...of those, ignore the local settings file | 11 / 12 |
Have a file named .env on the default branch (existence only) |
1 / 100 |
Have .claude/settings.local.json on the default branch (existence only) |
2 / 100 |
The Docker rows. A .dockerignore is nearly always present when there is a Dockerfile (28 of 30), yet 12 of those 30 have no .env pattern in it. .gitignore keeps a file out of Git; it does not keep it out of docker build .. If an image built on a developer machine is pushed, a local .env can travel inside a layer. Whether it does depends on the COPY lines, which we did not read.
.env may be a harmless placeholder.
Public, non-archived, non-fork repositories with at least 50 stars, pushed to within 30 days, from GitHub's public search for four topics (mcp, ai-agents, claude-code, llm), merged in turn until 100. For each repository two public files are read (.gitignore, .dockerignore) and five paths are checked for existence. No key, no account: Python standard library plus curl. The script is on the report page; run it and you get today's counts.
Three lines cover most of it:
.env
.env.*
.claude/settings.local.json
and the same .env lines in .dockerignore. To see what a folder would give away before you publish it, the free scanner runs in the browser (the files are not uploaded) and the command-line edition is MIT: https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto
Disclosure: this article was drafted with AI assistance (Claude) and checked against the measured results and the published files. Product links lead to our own paid kits.