You pushed your .env file to GitHub. Maybe you noticed a minute later, maybe a week later. Either way, you open the repo, see your database password sitting in plain text, and your stomach drops. Your first instinct is to delete the file and push again. Don't stop there. Deleting the file doesn't remove it from your Git history, so the secret is still in an old commit. Anyone who cloned or forked the repo in the meantime still has it. The good news is that the fix is a short list of step...