# We counted ignore rules in 100 public AI and MCP repositories (no names, script included)

> Source: <https://dev.to/zeuslab/we-counted-ignore-rules-in-100-public-ai-and-mcp-repositories-no-names-script-included-418p>
> Published: 2026-11-12 14:20:10+00:00

A missing line in `.gitignore` is not a leak. But it is the first thing between a secret and a public history, so we wanted to know how often the basic lines are actually there.

On 2026-11-12 we took 100 active public AI and MCP repositories and counted. We did not judge, and we name no repository here or in any file we publish. Nothing was reported to anyone.

**The page with every count, the method and the script: [https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto](https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto)**

|  | Count | 
|---|---|
| Have a `.gitignore` at the root | 97 / 100 | 
| Have an `.env` pattern in it | 76 / 100 | 
| Have a `.claude` /`settings.local.json` pattern in it | 59 / 100 | 
| Have a key-file or secrets pattern in it | 26 / 100 | 
| Have a `Dockerfile` at the root | 30 / 100 | 
| ...of those, have a `.dockerignore` | 28 / 30 | 
| ...of those, keep `.env` out of the build context | 18 / 30 | 
| ...of those, keep `.git` out of the build context | 21 / 30 | 
| Keep Claude Code settings in the repository ( `.claude/` ) | 12 / 100 | 
| ...of those, ignore the local settings file | 11 / 12 | 
| Have a file named `.env` on the default branch (existence only) | 1 / 100 | 
| Have `.claude/settings.local.json` on the default branch (existence only) | 2 / 100 | 

The Docker rows. A `.dockerignore` is nearly always present when there is a `Dockerfile` (28 of 30), yet 12 of those 30 have no `.env` pattern in it. `.gitignore` keeps a file out of Git; it does not keep it out of `docker build .`. If an image built on a developer machine is pushed, a local `.env` can travel inside a layer. Whether it does depends on the `COPY` lines, which we did not read.

`.env` may be a harmless placeholder.
Public, non-archived, non-fork repositories with at least 50 stars, pushed to within 30 days, from GitHub's public search for four topics (mcp, ai-agents, claude-code, llm), merged in turn until 100. For each repository two public files are read (`.gitignore`, `.dockerignore`) and five paths are checked for existence. No key, no account: Python standard library plus curl. The script is on the report page; run it and you get today's counts.

Three lines cover most of it:

```
# .gitignore
.env
.env.*
.claude/settings.local.json
```

and the same `.env` lines in `.dockerignore`. To see what a folder would give away before you publish it, the free scanner runs in the browser (the files are not uploaded) and the command-line edition is MIT: [https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto](https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto)

*Disclosure: this article was drafted with AI assistance (Claude) and checked against the measured results and the published files. Product links lead to our own paid kits.*