What is Git, commit, repository?

Git saves snapshots (commits) of your code in a repository, so you can see history and go back.

Where Git, commit, repository goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Working with your AI agent · 5 minutes · Pro
The commit that broke checkout
Checkout broke this morning. Since then you have also shipped discount codes, which work and which customers are already using.
How do I undo one commit but keep later changes?
Use git revert with the commit's hash: it adds a new commit that undoes just that change and keeps everything after it. To bring back a single file from before, use git restore --source=<hash> -- <file> and commit, after checking with git log -- <file> that no later commit changed it. Avoid git reset --hard on shared work, because it discards every commit after the point you choose.
Read the fix
Working with your AI agent · 4 minutes · Pro
Force-pushed away
Your agent 'cleaned up the branch' to resolve a conflict. Three days of commits are gone from GitHub.
How do I recover commits after a force push?
Act quickly. Git rarely deletes commits immediately: the reflog on the machine that had them, or GitHub's activity history, still shows the old commit ids, and you can recreate a branch from them. Then protect your main branch against force pushes and stop agents pushing without approval.
Read the fix
Money and secrets · 4 minutes · Pro
The key you deleted
Your AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.
Deleted my API key from GitHub. Still exposed?
Yes, if it was ever committed. Git keeps every version of every file, so the key is still in the repository history, and bots scan public repositories quickly. Revoke the key and create a new one first, then clean the history, and turn on secret scanning with push protection.
Read the fix
The life of a click · 4 minutes · Pro
Works on my machine
Sign-up works perfectly on your laptop. On the live site, every sign-up fails.
Why does it work locally but not in production?
The most common cause is a missing environment variable. Your .env file exists only on your laptop; production has its own settings. Add the variable in your hosting dashboard, redeploy, and validate required variables at startup so a missing one fails the deploy instead of your users.
Read the fix
Working with your AI agent · 4 minutes · Pro
The package that did not exist
Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.
Can an AI suggest a malicious npm package?
Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.
Read the fix
Keeping it running · 4 minutes · Pro
Update everything, deploy nothing
You asked your AI to 'update everything to the latest versions'. The app runs on your laptop, but the deploy fails and the live site is stuck on the old version.
Why does my build fail after updating packages?
Usually because a package jumped a major version, which can change how it works, or because package.json and the lockfile no longer match, so the build server installs different versions than your laptop or refuses to install. Update one package at a time, read upgrade notes for major versions, and commit the lockfile with package.json.
Read the fix

Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Deploy: Putting a new version of your app online so users get it.
AI coding agent: An AI tool that doesn't just suggest code but runs commands, edits files and installs things for you.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Production: The real, live version of your app that customers use, as opposed to the copy on your laptop.
Token: A temporary pass that proves who you are. Access tokens expire quickly; a refresh token quietly gets a new one.

All 62 terms in the glossary

Where Git, commit, repository goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Working with your AI agent · 5 minutes · Pro

The commit that broke checkout

Checkout broke this morning. Since then you have also shipped discount codes, which work and which customers are already using.

How do I undo one commit but keep later changes?

Use git revert with the commit's hash: it adds a new commit that undoes just that change and keeps everything after it. To bring back a single file from before, use git restore --source=<hash> -- <file> and commit, after checking with git log -- <file> that no later commit changed it. Avoid git reset --hard on shared work, because it discards every commit after the point you choose.

Read the fix

Working with your AI agent · 4 minutes · Pro

Force-pushed away

Your agent 'cleaned up the branch' to resolve a conflict. Three days of commits are gone from GitHub.

How do I recover commits after a force push?

Act quickly. Git rarely deletes commits immediately: the reflog on the machine that had them, or GitHub's activity history, still shows the old commit ids, and you can recreate a branch from them. Then protect your main branch against force pushes and stop agents pushing without approval.

Read the fix

Money and secrets · 4 minutes · Pro

The key you deleted

Your AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.

Deleted my API key from GitHub. Still exposed?

Yes, if it was ever committed. Git keeps every version of every file, so the key is still in the repository history, and bots scan public repositories quickly. Revoke the key and create a new one first, then clean the history, and turn on secret scanning with push protection.

Read the fix

The life of a click · 4 minutes · Pro

Works on my machine

Sign-up works perfectly on your laptop. On the live site, every sign-up fails.

Why does it work locally but not in production?

The most common cause is a missing environment variable. Your .env file exists only on your laptop; production has its own settings. Add the variable in your hosting dashboard, redeploy, and validate required variables at startup so a missing one fails the deploy instead of your users.

Read the fix

Working with your AI agent · 4 minutes · Pro

The package that did not exist

Your AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.

Can an AI suggest a malicious npm package?

Yes. AI models sometimes invent plausible package names, and attackers register those names with malicious code, an attack called slopsquatting. Installing a package can run its scripts immediately. Before installing an unfamiliar package, check it is real, widely used, linked to a real repository and has no unexpected install scripts.

Read the fix

Keeping it running · 4 minutes · Pro

Update everything, deploy nothing

You asked your AI to 'update everything to the latest versions'. The app runs on your laptop, but the deploy fails and the live site is stuck on the old version.

Why does my build fail after updating packages?

Usually because a package jumped a major version, which can change how it works, or because package.json and the lockfile no longer match, so the build server installs different versions than your laptop or refuses to install. Update one package at a time, read upgrade notes for major versions, and commit the lockfile with package.json.

Read the fix

Related terms

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Deploy

Putting a new version of your app online so users get it.

AI coding agent

An AI tool that doesn't just suggest code but runs commands, edits files and installs things for you.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Production

The real, live version of your app that customers use, as opposed to the copy on your laptop.

Token

A temporary pass that proves who you are. Access tokens expire quickly; a refresh token quietly gets a new one.