diff --git a/.gitignore b/.gitignore
index 478c387..da9ec4e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,22 @@ enrollment/
 drivers-staging/
 bios-staging/
 .claude/
+
+# Secrets and credentials (defensive)
+.env
+.env.*
+!.env.example
+!.env.*.example
+*.pem
+*.key
+id_rsa
+id_rsa.*
+*.ppk
+*.p12
+*.pfx
+secrets.json
+secrets.yaml
+secrets.yml
+*_secret
+*_secrets
+credentials.json