Windsurf ignored .gitignore and committed node_modules and .env
7.5/10
Severity
Ignored Instructions
Failure Mode
Reproducible
Yes
Date
March 21, 2026
Expected Behavior
Create .gitignore first, then git add only source files
What Actually Happened
Ran git add -A && git commit without checking .gitignore. Committed node_modules/ (47K files) and .env with credentials.
Damage Assessment
Credentials exposed in git history. Even after removing .env, it remained in git history requiring a force push and credential rotation.
Full Report
While setting up a new Next.js project, Windsurf ran git add -A and committed 47,000 files including the entire node_modules directory and a .env file containing database credentials and API keys.
Incident Metadata
- Agent
- Windsurf
- Failure Mode
- Ignored Instructions
- Root Cause
- Tool Misuse
- Task Type
- setup
- Domain
- frontend
- Source
- user_report