---
title: "Should I push appsettings.json file on GitHub in .NET application?"  
description: "Should I push appsettings.json file on GitHub in .NET application?"  
author: "Ravi Vishwakarma"  
published: 2026-05-21  
updated: 2026-05-22  
canonical: https://answers.mindstick.com/qa/116657/should-i-push-appsettings-json-file-on-github-in-dot-net-application  
category: "software"  
tags: [".net programming", "software"]  
reading_time: 2 minutes  

---

# Should I push appsettings.json file on GitHub in .NET application?

**Should I [push](https://www.mindstick.com/forum/23133/push-not-showing-when-app-is-open) [appsettings.json](https://www.mindstick.com/forum/158985/how-to-use-appsettings-json-in-asp-dot-net-core) [file](https://www.mindstick.com/articles/59/encrypting-and-decrypting-files-using-c-sharp) on [GitHub](https://www.mindstick.com/articles/327170/in-this-article-we-ll-talk-about-tfs-live-sharing-of-vscode-github-and-bitbucket-repository) in .NET [application](https://answers.mindstick.com/qa/33512/how-would-you-print-a-message-in-the-logcat-and-prevent-the-application-to-get-started)?**

## Answers

### Answer by Ravi Vishwakarma

> Usually: **no,**
>
> **not the real** `appsettings.json` **with secrets**.

In a .NET app, `appsettings.json` often contains things like:

- Database connection strings
- API keys
- JWT secrets
- SMTP credentials
- Azure/AWS keys
- Third-party service credentials

Those should **never** go to a public GitHub repo.

A good practice is:

## What to commit

Commit:

- `appsettings.json` → only if it contains **non-sensitive defaults**
- `appsettings.Development.json` → generally avoid if it has local secrets
- `appsettings.Example.json` or `appsettings.template.json` → recommended

Example safe template:

```plaintext
{
  "ConnectionStrings": {
    "DefaultConnection": "YOUR_CONNECTION_STRING"
  },
  "Jwt": {
    "Key": "YOUR_SECRET_KEY"
  }
}
```

## What to keep out of GitHub

Do NOT commit:

- Production secrets
- API keys
- Passwords
- Real connection strings
- OAuth secrets
- Certificates

Add sensitive files to `.gitignore` if needed:

```plaintext
appsettings.Development.json
appsettings.Local.json
```

## Recommended approach in .NET

### 1. Use `appsettings.json` for defaults only

```plaintext
{
  "Logging": {
    "LogLevel": {
      "Default": "Information"
    }
  }
}
```

### 2. Store secrets using User Secrets (development)

Use the built-in .NET Secret Manager:

```plaintext
dotnet user-secrets init
```

Set secrets:

```plaintext
dotnet user-secrets set "ConnectionStrings:DefaultConnection" "your-secret"
```

Microsoft docs:

[ASP.NET Core Secret Manager documentation](https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets)

### 3. Use environment variables in production

For [Docker](https://answers.mindstick.com/qa/116204/what-is-docker), [Azure](https://www.mindstick.com/interview/34451/what-is-azure-key-vault), [AWS](https://www.mindstick.com/articles/324863/what-are-the-advantages-of-using-aws), Render, Railway, etc.:

```plaintext
ConnectionStrings__DefaultConnection=...
Jwt__Key=...
```

## Best structure

```plaintext
appsettings.json                 ✅ safe defaults
appsettings.Development.json     ❌ local secrets
appsettings.Production.json      ❌ production secrets
appsettings.template.json        ✅ shareable template
```

## If you already pushed secrets to GitHub

Immediately:

- Rotate/revoke the secrets
- Remove them from git history
- Force push cleaned history

Useful tool:

[BFG Repo-Cleaner](https://rtyley.github.io/bfg-repo-cleaner/)

For professional .NET projects, the common pattern is:

- Commit configuration structure
- Never commit actual secrets
- Use Secret Manager locally
- Use environment variables or vaults in production


---

Original Source: https://answers.mindstick.com/qa/116657/should-i-push-appsettings-json-file-on-github-in-dot-net-application

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.