Putting a file in .gitignore does nothing if git already tracks it. I built a CLI to find the leftovers.

You added .env to .gitignore . You felt responsible. But three weeks later it's still in the repo, still pushed to GitHub, still in every clone — because adding a path to .gitignore does nothing to a file git already tracks. That's not a bug. It's documented behavior: .gitignore only stops untracked files from being added. Anything already committed keeps getting tracked, ignore rule or not. So the secrets, build artifacts, and 40 MB log files that were committed before someone wrote the rule just... stay. The fix is one command — git rm --cached — but only once someone notices . And nobody notices, because git status is clean and the file looks ignored. So I built gitslip : a zero-dependency CLI that finds every tracked file your own ignore rules say should be gone, and hands you the exact fix. $ npx gitslip 2 tracked files are ignored by your rules but still committed: config/secrets.env ↳ .gitignore:7 *.env logs/app.log ↳ .gitignore:2 *.log Fix — stop tracking them (keeps your local copy): git rm --cached -- config/secrets.env git rm --cached -- logs/app.log or let gitslip do it: gitslip --apply It tells you which rule caught each file ( .gitignore:7 *.env ), so there's no guessing. And --apply runs the git rm --cached for you — it only un-tracks, it never deletes your working copy. Why not just grep? You can grep your .gitignore patterns against git ls-files . But: A raw grep '\.env' can't tell a still-tracked leftover from a file that's correctly excluded, and it has no idea about !negation rules, build/ directory rules, nested .gitignore files, .git/info/exclude , or your global core.excludesFile . Reimplementing gitignore's matching semantics to get this right is exactly the kind of subtly-wrong code you don't want guarding your secrets. gitslip doesn't reimplement anything. It asks git. How it works (the fun part) Detection is a single git incantation: git ls-files -i -c --exclude-standard -c = tracked (cached), -i = ignored, --exclude-standard = use all the