Git and GitHub basics for vibe coders: never lose AI-written code

If you build with an AI agent, Git is your undo button. The agent can rewrite twenty files in a minute. Without version control, a bad change means rebuilding from memory. With it, you look at the diff and either keep the change or throw it away in one command. These Git and GitHub basics are all you need to start.

This guide covers the Git and GitHub basics for vibe coders: the handful of commands you need, a branch-per-task workflow that works well with coding agents, how to keep secrets and backups out of your repository with .gitignore, and the GitHub settings that catch leaked keys before they go public.

Why Git matters more when AI writes the code

Coding agent vendors build their safety advice around Git. OpenAI's Codex docs say Codex "works best with a version control workflow": work on a feature branch, keep git status clean before delegating, and commit frequently so you can roll back in small increments (Codex security docs). Codex even protects the .git folder as read-only in its default sandbox.

The reason is simple. Every agent change becomes a diff you can read, test and reverse. That turns "the AI broke my app" from a crisis into a two-minute fix.

Git and GitHub basics: the commands vibe coders need

You don't need to master Git. These cover most days:

git status                     # what changed since the last commit
git diff                       # the exact lines that changed
git switch -c add-invoices     # start a new branch for one task
git add -A                     # stage every change
git commit -m "Add invoices list and create form"
git push -u origin add-invoices
git switch main                # go back to the main branch
git restore path/to/file.ts    # throw away uncommitted changes to one file

The official Git documentation explains each command in full. The habit matters more than the commands: commit before you hand the agent a task, and commit again when the task works. Then any bad step is one git restore or git switch away.

A branch-per-task workflow for AI coding agents

Use the same loop for every feature:

1. Start clean. git status should say there's nothing to commit.
2. Create a branch named after the task: git switch -c fix-login-redirect.
3. Give the agent one task. Small tasks produce small diffs you can actually review.
4. Read the diff with git diff or in your editor. Our checklist for reviewing AI-generated code tells you what to look at first.
5. Commit and push the branch, then open a pull request on GitHub.
6. Merge when it's right. If you deploy with Vercel, every branch and pull request gets its own preview deployment with its own URL, and merging to main deploys to production (Vercel environments).

Before you open the pull request, our AI code review skill can check the diff for the riskiest problems first.

Keep secrets out of Git with .gitignore

A .gitignore file in your repository's root tells Git which files and folders to ignore when you commit (GitHub Docs). GitHub maintains official templates for most languages and frameworks in the github/gitignore repository. For a typical Next.js and Supabase app, make sure these are ignored:

# Secrets and local config
.env
.env.local
.env*.local

# Build output and dependencies
node_modules/
.next/

# Database exports
*.sql.gz
backups/

Two details trip people up:

• .gitignore doesn't affect files Git already tracks. If you committed .env.local before adding the rule, untrack it with git rm --cached .env.local, then commit. GitHub documents this as the way to ignore a file that's already checked in.
• Untracking doesn't erase history. If a real key was committed, assume it's exposed and rotate it at the provider. That's faster and safer than rewriting history.

Commit a .env.example with variable names only, so the agent and your teammates know what the app expects without seeing any values.

Turn on GitHub's secret protection

GitHub can stop some leaks before they happen:

• Push protection for users is on by default and stops you from pushing secrets to public repositories on GitHub. You can manage it under Settings > Code security (GitHub Docs).
• Push protection for repositories blocks pushes containing secrets from reaching a specific repository, whoever pushes. It's off by default, an admin enables it, and it requires GitHub Secret Protection (about push protection).

Don't treat these as your only defence. They recognize known secret formats, not every value that should stay private.

Your repository is your ownership

A repository in an account your business controls is the foundation of owning your code and data. Pair it with regular database backups and you can rebuild your whole product from what you hold.

Keep reading

• How to run coding agents safely: permissions, sandboxes and secrets
• What is AGENTS.md, and how to write one
• Pre-deploy check skill for coding agents

FAQ

Do I need Git if an AI agent writes my code?

Yes. Git turns every agent change into a diff you can review and reverse. OpenAI recommends working on a feature branch, keeping git status clean and committing frequently when using Codex.

How do I stop .env files from being committed?

Add .env and .env*.local to a .gitignore file in the repository root. If a file is already tracked, untrack it with git rm --cached and commit the change.

What should I do if I committed an API key?

Rotate the key at the provider right away, then remove it from the code and untrack the file. Assume a committed key is exposed even if you delete it later.

What is GitHub push protection?

Push protection blocks pushes that contain supported secrets. Push protection for users is on by default for public repositories, and push protection for repositories requires GitHub Secret Protection.