Project has no .gitignore
ID |
gitignore_present |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Family |
SCM |
Tags |
ASVS50:v14.2.1, non-reachable, security, source-code, spvs10-v1.5.2, supply-chain |
Description
Does the project have a .gitignore file at its root?
A .gitignore declares the files Git must never track. Without one it is easy to accidentally commit build output, local editor/IDE configuration, and — most dangerously — credential and secret files (.env, *.pem, cloud key JSON). The check reports a project whose root has no .gitignore (SPVS V1.5.2).
The check looks for a .gitignore at the project root. A .gitignore that exists only inside a subdirectory does not satisfy the root-level control.
|
| To avoid false positives, the finding is reported only for repositories that actually contain source code. A documentation-only, configuration-only or empty repository has nothing that needs ignoring and is not reported. |
Security
A root .gitignore is the first, cheapest line of defence against secret leakage through version control: excluded files never enter a commit, so they cannot leak through history, forks, or clones. It complements (does not replace) secret scanning.
Mitigation / Fix
Add a .gitignore to the project root that excludes build artifacts, dependency directories, local configuration, and secret material. Start from a language-appropriate template (for example github/gitignore) and add entries for any local secret files.