--- template/app/.gitignore
+++ opensaas-sh/app/.gitignore
@@ -1,2 +1,20 @@
 node_modules/
 .wasp/
+
+.env
+.env.*
+
+# These two we added only because dotenv-vault keeps adding them if it doesn't find them,
+# even though we don't need them. Remove them once dotenv-vault stops doing that.
+.env*
+.flaskenv*
+
+# Don't ignore example dotenv files.
+!.env.example
+!.env.*.example
+
+# We don't want to ignore .env.client as it doesn't have any secrets.
+!.env.client
+# These are config files for dotenv-vault, so we don't want to ignore them.
+!.env.project
+!.env.vault