Seven x2y tools remain free. Code Leak Detector is $29 as a one-time purchase.
View productsNever Commit Secrets Again
The essential security companion for modern developers. Whether you are working in Python, Node.js, React, or C++, ensuring your sensitive data stays out of your public repositories is critical. Generate the perfect .gitignore file in seconds and audit existing projects for dangerous exposures.
Free — no account, no cloud lookup, no telemetry. Templates ship with the app and work entirely offline.
At a glance
Templates are bundled locally and never fetched over the network — so it works on a plane, in a lab or on a fresh machine.
Key features
Select your stack from curated templates, preview the merged output in real time, and write directly to your repository root. The generator combines rules intelligently — no duplicates, no conflicts, no manual editing required.
Point the scanner at any repository and it identifies files that should be ignored but are not — .env files, API keys, credentials, build artifacts, OS metadata and editor swap files. Catch the exposure before it reaches a remote.
Build your own template combinations and save them for future projects. Export and import templates as portable files so your team shares the same ignore standards across every repository.
Generate the output and copy it to your clipboard with one click, or write it atomically to the target directory. The diff preview shows exactly what will change before anything is written — no surprises.
Supported templates
Each template is maintained and updated locally within the application. No network fetch is required — the full template library ships with the installer and works in air-gapped environments.
Specifications
| Product | x2y GitIgnore Generator |
|---|---|
| Version | v1.0.0 |
| Platform | Windows |
| Templates | 20+ curated (languages, frameworks, editors, OS) |
| Template storage | Bundled locally — no network fetch |
| Repository scanning | Detects unignored sensitive files |
| Audit targets | .env, API keys, credentials, build artifacts, OS metadata, editor swaps |
| Custom templates | Create, save, export, import |
| Output | Copy to clipboard or atomic file write |
| Diff preview | Shows changes before writing |
| Merge logic | Deduplication and conflict resolution |
| Telemetry | 0 bytes — verified continuously |
| Account required | None — ever |
| Price | Free |
| Developer | x2y Devs Tools Ltd, Nairobi, Kenya |
Quick start
Download from Microsoft Store, itch.io or Uptodown. Run the installer — no administrator privileges required for standard installs. No account creation, no activation key.
Open the Generate tab and check the templates that match your project — Node.js + VSCode + macOS, for example. The preview pane updates in real time as you toggle templates.
Switch to the Audit tab and point it at a repository. The scanner identifies files that should be ignored but are not — .env files, credential stores, build outputs — and flags them by severity.
Review the diff preview, then write atomically to the repository root or copy the output to your clipboard. Save the template combination for reuse on future projects.
git filter-repo or BFG Repo-Cleaner to purge it from history. The Code Leak Detector can help identify what was exposed.Downloads
Changelog
Initial release. 20+ curated templates covering Node.js, Python, React, Vue, Angular, PHP, Ruby, Rust, C++, C#, Java, Go, Swift, Kotlin, macOS, Windows, Linux, VSCode, Vim, IntelliJ, Sublime Text, Unity and Unreal Engine. Repository scanning for unignored sensitive files (.env, API keys, credentials, build artifacts, OS metadata, editor swaps). Custom template creation, save, export and import. Real-time merge preview with deduplication. Atomic file write with diff preview. Copy-to-clipboard output. Built-in help guide. 100% offline — all templates bundled locally.
Security model
x2y GitIgnore Generator reads the file tree of the repository you point it at — that is its function. It does not transmit the file list, the generated .gitignore content, or any other data anywhere. The template library is embedded in the installer and exists entirely on your filesystem. There is no analytics SDK, no crash reporter, no licence verification call, no cloud sync. Verify with Wireshark, Fiddler, GlassWire or your firewall logs — you will observe zero outbound connections.
| Telemetry | 0 bytes collected |
|---|---|
| Account | None required — ever |
| Repo scanning | Only directories you explicitly select |
| Template library | Bundled locally, never fetched |
| Generated output | Never transmitted |
| Network | Zero outbound connections |
| Verification | Any network monitor |
Why this file matters
A missing entry costs nothing on Monday and everything on the day you open-source the repository. .env files, key pairs, database dumps and IDE swap files look like harmless local clutter right up until they are indexed by a search engine and swept by credential crawlers.
Ignoring files is not a formatting preference; it is the first line of defence for secrets. That is why this generator treats an existing repository as a first-class input, not an afterthought: generate the file, then audit what is already tracked.
Real projects are a stack: Node plus React plus VS Code plus macOS, or Python plus Django plus PostgreSQL. Choosing one template is how half the gaps appear. The generator lets you select several, merges them with deduplication and conflict resolution, and shows a diff preview before it writes — so you can see what changed instead of trusting a paste.
All 20-plus templates ship inside the app. Nothing is fetched from a gist or a repository at runtime, which means the output is reproducible and works with the network cable out.
The scanner walks a repository for the exposures that survive a good intention: unignored .env files, API keys and credential material, build artefacts, OS metadata like .DS_Store and editor swap files. It reports what should be ignored and, importantly, what is already tracked.
Tracked files are the trap. Removing a path from tracking with git rm --cached stops future commits from including it; it does not erase it from history, and it does not make a committed credential safe. Rotate the credential, then decide how much history you must actually rewrite.
Your stack is probably not in any public list: the internal SDK folder, the licence file that must never ship, the generated client directory. Create a custom template, save it, export it to a colleague, import it on the next machine. It stays on disk as a plain file you can diff and version.
Atomic writes and a copy-to-clipboard output cover both habits: let the tool write the file with a previewed diff, or take the text and paste it into your own commit.
How it works
Tick the languages, frameworks, editors and operating systems in play. The merge step deduplicates and resolves conflicting rules.
For a new file, read what will be written. For an existing .gitignore, the diff shows exactly which lines are added or changed before anything touches disk.
Run repository scanning to find unignored sensitive files and build artefacts that survived a previous ignore — including files already tracked.
Atomic file write or clipboard copy, your choice. Save the combination as a custom template for the next project in the same stack.
| Template scope | Languages, frameworks, editors, OS, IDEs |
|---|---|
| Merge behaviour | Deduplication with conflict resolution |
| Audit targets | .env, keys, credentials, artefacts, OS and editor noise |
| Write mode | Atomic write with diff preview, or clipboard |
| Custom rules | Create, save, export, import as plain text |
| Offline | Every template bundled in the app |
git status --ignored in the repository to confirm your sensitive paths are listed as ignored. If a file was already tracked, git rm --cached it and rotate any credential it contained.Who it is for
The moment a private repository turns public is the moment every tracked secret is collected. Generate and audit before you flip the switch.
One custom template per client stack, exported and versioned, so the next project starts from your standard rather than a stranger's gist.
Unity and Unreal directories, keystores and provisioning profiles are exactly the artefacts that must never be committed.
A fast, offline check for exposure before a repository is shared, published or handed over.
The habit costs a minute now and prevents the most common first-repository mistake there is.
Existing repositories are where the surprises are. The audit reads the tree you inherited and tells you what to fix first.
Prerequisites
| Requirement | Details | Notes |
|---|---|---|
| Operating system | Windows 10 or Windows 11 | No .NET or runtime prerequisite to install separately |
| Repository | A folder containing your project | Git does not need to be initialised to generate the file |
| Privileges | Standard user account | Writes only where you have file permissions |
| Network | None | Templates are bundled; nothing is fetched at runtime |
Existing .gitignore | Read, diffed, merged | Never overwritten silently — the diff preview shows the change |
| History rewriting | Out of scope, deliberately | Rotate credentials first; history surgery is a git operation |
| Verification | Published SHA-256 checksum per release | Compare with PowerShell Get-FileHash before installing |
Context
| Concern | x2y GitIgnore Generator | Online template collections | Hand-written .gitignore |
|---|---|---|---|
| Multi-stack merge | Deduplicates and resolves conflicts | Manual concatenation, duplicates and gaps | Whatever you remembered |
| Audit of tracked files | Built in | None | None |
| Works offline | Fully | Needs a browser and a fetch | Yes |
| Diff preview before write | Yes, atomic write | Copy-paste and hope | You are the diff |
| Reusing your own stack | Custom templates, export and import | Your bookmarks folder | Your project templates |
| Cost | Free | Free, usually with ads | Your time |
Questions
.env was already committed.git rm --cached stops future tracking; it does not remove the past..gitignore text and reports findings. The audit is read-only, and any write goes through a diff preview with an atomic file write, so you always see the exact change first..env files, key material, credential files, build artefacts, OS metadata and editor swaps. Ignored directories are not interesting — the question is always what is not ignored..gitignore files still follow the usual Git rule that ignore patterns are evaluated per directory.Documentation
Ready to protect your repo
No account. No telemetry. No cloud. Just a fast, offline tool that keeps your secrets out of Git history and your repositories clean.
| Version | v1.0.0 |
|---|---|
| Platform | Windows |
| Price | Free |
| Telemetry | 0 bytes |