Glitch GitHub import as restore: does it overwrite or preserve .env secrets and uploaded assets?

Direct answer

Importing a GitHub repository into a Glitch project is a source-file restore, not a project-state restore. Files present in the repository overwrite their counterparts in the project. Anything the repository does not contain — the .env file and the uploaded-asset store — is left as it is. A re-import therefore does not revert secrets you changed after export, and it does not delete or re-upload assets you removed.

What each piece does on import

The exception: a committed .env

If the repository contains a .env — because it was committed manually or the ignore rule was changed — the import treats it like any other file and overwrites the project's .env. Check before importing:

git ls-files -- .env
git log --oneline -1 -- .env

Empty output from the first command means the secret was never versioned, so the import has nothing to overwrite it with.

Assets and CDN URLs

Uploaded files live in the project's asset store, referenced by metadata that maps asset records to CDN URLs. The GitHub export does not carry the binaries. After a round trip, an asset still present in the project keeps serving from its original URL; one you deleted stays deleted, because the import has no binary to restore. Asset references in your source can therefore point at URLs that no longer resolve — that is drift, not an import failure.

Verifying in a disposable project

1. Create a throwaway project, add TEST_SECRET=one to .env, upload a small text file, and note its URL.
2. Export to GitHub into a fresh repository.
3. In the editor, change the secret to TEST_SECRET=two, add a second key, and delete the uploaded asset.
4. Import the repository back into the same project.
5. Inspect .env: if it still reads two plus your extra key, secrets were preserved. Check the asset URL: if it no longer resolves, the deletion was preserved.
6. Confirm no .env appeared from the repository.

Making a restore authoritative

There is no documented import option that replaces hosted state. To get that behaviour you must clear the state yourself first: remove the keys you want reverted from .env, delete the assets you want gone, then import. Keep secrets in a dedicated secret manager or encrypted backup, because the repository is not a secret store.

Uncertainty and review notes

• Exact behaviour can differ by project type and by tooling changes; treat the steps above as the test, not the guarantee.
• Glitch has announced a wind-down of project hosting. Confirm the editor and GitHub import are still reachable in your account before depending on this path. Marked for review.
• A backup strategy that relies on GitHub alone will silently drift from the hosted environment whenever secrets or assets change outside the repository.