As we've been working with .env files, I've made it a point to note that these files should never be committed to the repository. In fact, a good practice is to add an entry to your .gitignore file before you create any sensitive files to ensure you never accidentally commit your credentials. Even if you later delete it from your repository, the file history is maintained and you'll have to invalidate (or cycle) those keys so that they are not exposed in history.
While a full section on Git is beyond the scope of our work here, let's take a look at an example of a .gitignore file:
# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
# dependencies
/node_modules
/.pnp
.pnp.js
# testing
/coverage
# production
/build
# misc
.DS_Store
.env*
npm-debug.log*
yarn-debug.log*
yarn-error.log*
Several of these are entries created by the create-react-app scaffold. Note specifically .env*. The asterisk (or...