We counted ignore rules in 100 public AI and MCP repositories (no names, script included)

A missing line in .gitignore is not a leak. But it is the first thing between a secret and a public history, so we wanted to know how often the basic lines are actually there.

On 2026-11-12 we took 100 active public AI and MCP repositories and counted. We did not judge, and we name no repository here or in any file we publish. Nothing was reported to anyone.

The page with every count, the method and the script: https://zero-trace-ship-kit.zeus-lab-global.workers.dev/report/?utm_source=devto

What we counted

The one that stood out to us

The Docker rows. A .dockerignore is nearly always present when there is a Dockerfile (28 of 30), yet 12 of those 30 have no .env pattern in it. .gitignore keeps a file out of Git; it does not keep it out of docker build .. If an image built on a developer machine is pushed, a local .env can travel inside a layer. Whether it does depends on the COPY lines, which we did not read.

How to read these numbers

• An absent rule is not a leak. The file may not exist, a global ignore may cover it, or habit may.
• "Pattern present" is a line-by-line match of common spellings, not a full implementation of gitignore semantics.
• For the two "existence only" rows we asked whether the path exists on the default branch. We never downloaded the contents, so a file named .env may be a harmless placeholder.
• The sample moves daily. A later run gives somewhat different counts.

The sample and the method

Public, non-archived, non-fork repositories with at least 50 stars, pushed to within 30 days, from GitHub's public search for four topics (mcp, ai-agents, claude-code, llm), merged in turn until 100. For each repository two public files are read (.gitignore, .dockerignore) and five paths are checked for existence. No key, no account: Python standard library plus curl. The script is on the report page; run it and you get today's counts.

Check your own folder

Three lines cover most of it:

# .gitignore
.env
.env.*
.claude/settings.local.json

and the same .env lines in .dockerignore. To see what a folder would give away before you publish it, the free scanner runs in the browser (the files are not uploaded) and the command-line edition is MIT: https://zero-trace-ship-kit.zeus-lab-global.workers.dev/?utm_source=devto

Disclosure: this article was drafted with AI assistance (Claude) and checked against the measured results and the published files. Product links lead to our own paid kits.