AP007: Personal agent file not gitignored
| Severity | low |
| Runs in | scan, git push check |
| One-line fix | Add the file to .gitignore (and untrack it with git rm –cached if it was committed) so personal agent settings and keys never reach the repo. |
What it finds
Section titled “What it finds”A personal agent file inside a git repository that git would publish. Personal files are the ones
that belong to one person: Claude Code’s .claude/settings.local.json and CLAUDE.local.md,
Gemini CLI’s .gemini/.env. The print says whether the file is committed or only unignored,
which means git add . would commit it.
Why it matters
Section titled “Why it matters”These files hold one person’s approvals, notes and sometimes keys. Once pushed, they are in the repository’s history for everyone who can read it.
How to fix
Section titled “How to fix”Add the file to .gitignore. If it is already committed, also remove it from git with
git rm --cached <file>. If it held a key, rotate the key: it is in the history.
Limits
Section titled “Limits”- Uses only local git commands. No network, nothing is written.
- It honours
.gitignore,.git/info/excludeand your global excludes file. - Outside a git repo, or if git is missing, there is no print.
- This is a low print: the file is only a risk until it is pushed.