From 70a43fda8b99646061be90507afadc2815354f0d Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Fri, 17 Apr 2026 12:50:13 -0400
Subject: [PATCH] Add defensive .gitignore patterns for secrets/keys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Blocks .env, *.key, *.pem, id_rsa*, secrets.*, credentials.json, etc.
Preventive — no exposure found; future commits can't accidentally
leak these.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.gitignore b/.gitignore
index a25f8f3..cc6c39c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,22 @@ cve_details_*.csv
 .idea/
 .vscode/
 *.swp
+
+# Secrets and credentials (defensive)
+.env
+.env.*
+!.env.example
+!.env.*.example
+*.pem
+*.key
+id_rsa
+id_rsa.*
+*.ppk
+*.p12
+*.pfx
+secrets.json
+secrets.yaml
+secrets.yml
+*_secret
+*_secrets
+credentials.json