# Secrets — never commit
.env
.env.*
!.env.example
*.secret
*.pem
*.key
*.p12
*.pfx
credentials.json
secrets/

# Python
.venv/
venv/
ENV/
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
.eggs/
dist/
build/
*.egg
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage
htmlcov/
.tox/
.nox/

# Tool / IDE
.idea/
.vscode/
*.swp
*.swo
*~
.DS_Store

# Local operator config outside example
*.local
local.env

# SBOM / audit artifacts (regenerate; do not commit with secrets)
sbom.json
pip-audit.json

# Demo scratch (keep tracked PNGs that are already redacted; ignore accidental dumps)
demo/out/*.env
demo/out/*secret*
