GitHub: A Safe Copy of Your App's Code

What it does

GitHub stores your app's code online, with a history of every change you've saved. If your laptop gets dropped in a flooded crawlspace, your code doesn't go with it. It's also what Vercel watches: save a change to GitHub and your live app updates.

What it costs

• Free: $0 a month, with unlimited public and private repositories (a repository is one project's folder of code). That covers a one-shop restoration or remodeling tool.
• Team: $4 per user a month. GitHub's pricing page labels that price "for the first 12 months" and doesn't list the price after that, so ask GitHub before you count on it. You only need Team if several people work on the code together.
• Most owners never pay for GitHub itself. AI add-ons like Copilot are billed separately.

A 10-minute setup

Where your keys go. Every service here gives you secret keys. Keep them in exactly two places: your password manager, and your app's settings.

• If an AI agent with its own cloud computer builds for you (like Grok Bot): paste each key into the agent's secret card or Secrets section, never into the chat. Saved values can't be read back, so keep your own copy.
• If you build in a folder on your own computer: put keys in a .env.local file, and make sure .gitignore lists .env* before your first save.
• On Vercel: add the same keys under Settings, Environment Variables, then redeploy.

Never put a key in a screenshot, an email, or browser code. Anything starting with NEXT_PUBLIC_ is readable by anyone.

1. Create a free account at github.com and turn on two-factor sign-in.
2. Before your first save, make sure your project has a .gitignore file that lists .env*. That keeps your secret keys off GitHub.
3. Ask your AI coding assistant: "Create a private GitHub repository for this project and push my code to it."
4. On github.com, open the new repository and confirm it says Private.
5. Look through the files. You should not see .env.local. If you do, see the first gotcha.

Common mistakes and gotchas

• Committing a secret key. Deleting the file afterward isn't enough, because the history keeps it. Change the key in that service's dashboard first, then clean up.
• GitHub's safety net is thin on free private repositories. Push protection, which blocks you from pushing a secret, is on by default for your account but only for public repositories. Your .gitignore is the real protection.
• Making the repository public by accident. Your job addresses, homeowner names, and adjuster contacts don't belong on the open internet, even as test data.
• Saving isn't the same as pushing. Your code isn't backed up until it's pushed. Push at the end of every work session.

Where it fits in your build

Set up GitHub right after you pick your AI assistant and before anything goes live. Add .env* to .gitignore before your first save, create a private repository, and push. Vercel reads from this repository, so every push can update your live app.

Sources

• GitHub pricing (Free $0 with unlimited public and private repositories, 2,000 Actions minutes and 500 MB of package storage; Team $4 per user a month and Enterprise from $21 per user a month, both "for the first 12 months" in the comparison table): https://github.com/pricing (checked October 7, 2026)
• Push protection (on by default for users, public repositories only; repository-level protection needs GitHub Secret Protection): https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection (checked October 7, 2026)

Last checked: October 7, 2026

Read the full guide

---

Full article

Why a restoration or remodeling owner needs this at all

You wouldn't keep the only copy of a signed work authorization in your truck's glovebox. Your app's code is the same. GitHub is the filing cabinet in the office: a second copy, kept somewhere safe, with every version labeled by date. When a change your assistant made to the drying log screen breaks something, GitHub is how you get yesterday's working version back.

A few words you'll hear:

• Repository (repo): one project's folder, plus its full history.
• Commit: one saved checkpoint, with a short note saying what changed ("Added moisture reading field to drying log").
• Push: sending your commits from your computer up to GitHub.

What it costs, in more detail

• Free, $0: unlimited public and private repositories, 2,000 minutes a month of GitHub Actions (automated tasks), and 500 MB of package storage. A single-shop tool won't come close to those limits.
• Team, $4 per user a month: adds features for groups reviewing each other's code. Note the "first 12 months" wording on GitHub's page.
• Enterprise: from $21 per user a month, with the same "first 12 months" wording. Not something an owner-built tool needs.
• Secret Protection is a paid add-on that turns on push protection for private repositories. This guide doesn't recommend paying for it on a one-person project. Get .gitignore right instead.

The full setup, step by step

1. Create your account at github.com. Use an email you'll keep. Turn on two-factor sign-in when it offers. This account now guards your business tool.
2. Check .gitignore before anything else. Ask your assistant: "Show me my .gitignore file and confirm .env and .env.local are excluded." Read the answer. If it isn't there, have it added now, before any commit.
3. Make the first commit. Ask: "Set up git in this folder and make a first commit called 'Starter project.'"
4. Create the repository and push. Ask: "Create a private GitHub repository called restoration-job-tracker (or whatever you name it) and push my code to it." Your assistant will have you sign in to GitHub. Approve it in the browser window that pops up.
5. Check it on the website. Open github.com, click your repository, and confirm three things: it says Private, you see your project files, and there's no .env.local in the list.
6. Connect Vercel (see the Vercel guide). From now on, every push updates your live app.
7. Build the habit. At the end of each session, ask: "Commit my changes with a plain-English message and push them."

More gotchas worth knowing

• If a key does get pushed: go to that service's dashboard (Supabase or Neon, Twilio, Resend, Stripe) and rotate the key first. That kills the leaked one. Then ask your assistant to remove it from the history. Rotating comes first because the leaked key may already have been copied.
• Screenshots leak keys too. Don't post or send a screenshot of your .env.local file or a dashboard page showing a full key.
• Real customer data in the repository. Test data with real homeowner names, addresses, or claim numbers shouldn't be committed, even to a private repository. Use made-up jobs.
• "It's on my computer" isn't a backup. If you haven't pushed in a week, a week of work lives in one place.
• Don't fight your assistant's git commands. If it suggests something with the words "force" or "reset," ask it to explain what would be lost before you say yes.

How to use it day to day

Save a known-good point before any big change ("Before change-order screen"), then make one commit per fix. When something breaks, you'll know exactly which change did it, and you can get yesterday's working version back.