node_modules/
.next/
data/corrections.jsonl
data/gap-reports.jsonl
cf/out/
cf/.stage/
shots2/
cf/.dev.vars
# and every backup of it. `cf/.dev.vars` alone does not match
# `cf/.dev.vars.20260909T195900Z.bak`, which rotate-secrets.sh writes and which
# holds the value that was just retired — still a live secret until the rotation
# has propagated everywhere.
cf/.dev.vars.*
cf/.wrangler/
.wrangler/
data/*.jsonl
cf/out-*/
cf/.stage-*/

# generated by scripts/export-public-repo.sh; rebuilt on every static build
public/waypoint-ledger-source.tar.gz

# generated on every build (never committed; the deploy gate requires a clean tree)
cf/out/
cf/out-*/
public/build.json
tsconfig.tsbuildinfo

# ── 2026-09-30 exposure audit: secrets, keys, CUI and NDA material never enter git ──
# (the hourly backup stages every untracked file under 25 MiB, so this file is the only gate)
.env
.env.*
**/.env
**/.env.*
!**/.env.example
!**/.env.sample
!**/.env.template
.dev.vars
.dev.vars.*
**/.dev.vars
**/.dev.vars.*
*.key
*_key.pem
*-key.pem
*.p12
*.pfx
*.jks
*.keystore
id_rsa*
id_ed25519*
id_ecdsa*
.netrc
**/.netrc
client_secret*.json
*service-account*.json
*service_account*.json
*gmail-sa-key*.json
token.json
token.pickle
**/credentials.json
**/cui/
**/CUI/
**/HARMONIC/CONFIDENTIAL/*
!**/HARMONIC/CONFIDENTIAL/.gitignore
.next-*/
