Putting a file in .gitignore does nothing if git already tracks it. I built a CLI to find the leftovers.

You added .env to .gitignore. You felt responsible. But three weeks later it's still in the repo, still pushed to GitHub, still in every clone — because adding a path to .gitignore does nothing to a file git already tracks. That's not a bug. It's documented behavior: .gitignore only stops untracked