// HACKER NEWS — CYBERSECURITY
Two Git ignore files nobody told me about
One of my many bad habits is carrying untracked files around in the repositories I work on.
I did learn, some time ago, that those files must never contain secrets, because sooner or later they get committed by mistake. I learned it the easy way, by watching a colleague learn it the hard way: furiously rewriting history to cover his tracks, then rotating cloud credentials in a panic.
These days the untracked files are harmless. Random markdown notes and, more often than not, agent plans. I haven't started committing those yet. They go stale fast, and I'm not convinced they're worth the effort.
So why put up with a permanently dirty working tree? Because until very recently, the only way I knew to ignore a file in git was to add it to .gitignore. And .gitignore gets committed. That's exactly right for things everyone cloning the repo will have, like the classic .env, but pushing the silly filename I picked for my private notes to a remote repository feels unclean. So I did nothing, and the untracked files piled up. About ten plans at the last count.
But then Claude asked, out of the blue, something along the lines of "would you like me to add these files to .git/info/exclude?"
It turns out git reads ignore patterns from three places, all with the same syntax.
The per-repo one, .git/info/exclude, is the one I'm giddy about. It lives inside .git, so it can't be committed even by accident, and nobody else ever sees it. I'll probably move some things into ~/.config/git/ignore soon too; editor clutter has no business in any project's .gitignore, and yet there it is, in most of them.
Of course, all of this is laid out very nicely in the official documentation, if only I'd thought to read it, or even to search for it. I didn't, and I'd wager a small sum that git is the tool most of us learned by accident, some of them fortunate, some less so. Thankfully, this one was the former.
The two new ones are plain text files that take the same patterns as .gitignore. There's no dedicated git command; you just append to them.
Patterns are matched relative to the repository root, exactly as they would be in a top-level .gitignore. The file is usually already there, with a few commented-out examples in it. One catch: in a linked git worktree, .git is a file rather than a directory, so the path above won't work. The exclude file lives in the main repository's .git/info/exclude and covers every worktree. This resolves to the right file from the main repository and from any linked worktree: