STUPID-2026-0007
Severity 7.5/10 — HIGH
Verified
Windsurf ignored .gitignore and committed node_modules and .env
Agent: windsurf
Language: javascript
Domain: frontend
Failure Mode
Ignored Instructions
Root Cause
Tool Misuse
Task Type
Setup
Reproducible
Yes
Description
While setting up a new Next.js project, Windsurf ran git add -A and committed 47,000 files including the entire node_modules directory and a .env file containing database credentials and API keys.
Instruction Given
Initialize the project with git and make the first commit
Expected Behavior
Create .gitignore first, then git add only source files
Actual Behavior
Ran git add -A && git commit without checking .gitignore. Committed node_modules/ (47K files) and .env with credentials.
Impact / Damage
Credentials exposed in git history. Even after removing .env, it remained in git history requiring a force push and credential rotation.
Source: User Report
Reported March 21, 2026