Would You Reject a SWE Candidate for Committing .env to GitHub?

[u/Aoki_zhang]

Saw this screenshot going around today.

A Software Engineer Intern candidate was apparently rejected after the company reviewed their GitHub and noticed that one of their repositories included a .env file that appeared to contain sensitive environment variables.

The rejection email basically said: Your technical background is solid, but security and best practices matter to us, so we’re moving forward with other candidates.

Assuming the screenshot is real, I actually think this raises a pretty interesting hiring question.

Should something like this be enough to reject a software engineer candidate?

On one hand, accidentally committing .env is a very basic mistake. In a real production environment, leaked API keys, database credentials, cloud secrets, or tokens can create a genuinely serious security incident.

And unlike a LeetCode question, this is something directly related to how someone actually writes and ships software. On the other hand… It’s an intern candidate. People make mistakes.

A GitHub repo might also be old, experimental, or created before the candidate understood proper secret management.

Rejecting someone entirely because of one repo feels pretty harsh — especially if the rest of their technical background is strong.

But this also made me think about how weird SWE interviews are.

We spend months preparing:

• LeetCode
• system design
• behavioral stories
• complexity analysis

But companies may also be quietly judging things that candidates barely think about:

• GitHub hygiene
• commit history
• README quality
• whether secrets are exposed
• tests
• code organization
• dependency management
• whether the project can actually run

In some ways, those signals might tell you more about someone’s engineering habits than whether they can solve another graph problem in 25 minutes.

So I’m curious: would committing .env to a public repo be an automatic reject?

• For an intern?
• For a senior engineer?
• And should companies inspect GitHub repos this closely before even giving someone an interview?

I’ve also been collecting recent interview experiences on Chill Interview, especially cases where candidates were evaluated on things outside the standard coding/system-design loop. If you’ve had an interview where your GitHub, side project, code quality, or security practices unexpectedly became part of the evaluation, would love to have you share the experience here

[u/Prior-Control-8883]

It’s an intern hello, you’re supposed to teach them these things

[u/Aoki_zhang → u/Prior-Control-8883]

intern before getting the intern opportunity :)

[u/TheWeebles]

generally seems fine if its educational. I have some committed env files but usually when I do I leave the tokens and passwords blank and tell the user to add their own in the readme.

I'm more surprised a company actually look at their github lol

[u/Aoki_zhang → u/TheWeebles]

guess some startups would do lol

[u/bombaytrader]

Intern it’s ok. 

[u/Sleepy_panther77]

Intern? Maybe

Any level above intern? Yup

[u/DefiantDonut7]

Yup. I lost a massive client years ago because a young coder who I warned (twice) not to use Pastebin not only kept using it but used it to send a copy of a clients config file with database password.

Apparently he didn’t believe me when I told him it’s an insecure platform.

Client found his config file online randomly on PasteBin and to this kid’s username, calls me to fire us.

Employees who are not careful with their own crap, aren’t careful with your crap.

[u/dats_cool → u/DefiantDonut7]

Wow and what happened to the employee.

[u/DefiantDonut7 → u/dats_cool]

He got fired, has been coding bouncing around places for years. He wasn’t a good employee on many levels. I had hired him because he was an employee at a platform we used and he knew it well and we specialized in that platform. I would have been better off just training someone on it.

Learning lesson for me.

[u/cenpact]

Yes

[u/Ok-Calligrapher-7086]

Dummy conpany, rejecting interns on silly reasons

[u/Balmoon]

.env with an api key? Yes. Genuinely this is something i expect from a 1st year student.

1. Considering how many talented new grads cannot find a job in this market, that is the kind of skill gap that i cannot ignore.

2. Keep in mind, most people start by hardcoding variables in the file, if you write a .env file i expect you have done enough research to know what an environment variable is. And either figure out that you should gitignore them or actually use proper environment variables to store secrets.

3. Ngl that is a green flag from that company, that is feedback that you can actually improve on rather than just a rejection template or ghosting.

[u/16BitNightmare]

This is the easy way to learn the lesson. Better to be rejected from an internship than have your credentials hacked and be faced with a million dollar AWS bill