The .env committed on day one
A .env went in with the first commits and had to be rotated and removed the same day.
The safety net had a hole
The test, the audit log, the scanner, the CI run — covering less than I assumed it did.
Went in with the first few commits, came back out the same day. .gitignore before anything else on a new project.