max / balanced_breakfast

Carry the shared secrets baseline in .gitignore Only MNW ignored *.pem/*.key/*.p8/*.p12/*.pfx, and spaghetti, buckets_of_money and most libraries had no .env rule at all, so the guardrail depended on which repo a secret happened to land in. Suffix matching rather than *.env keeps committed environment files that hold no secrets visible, and .env.example is negated back in.

Author: Max Johnson <me@maxj.phd> · 2026-08-08 23:47 UTC

Signed with PGP, not checked

Commit: fde15877e0b672edacd01b24301f4ea8867a8e14

Parent: e2af75a

1 file changed, +14 insertions, -0 deletions

M .gitignore +14

			@@ -45,3 +45,17 @@
45	45		# Generated by src-tauri/build.rs from makeover-geometry's scale
46	46		/src-tauri/frontend/css/geometry.css
47	47		/src-tauri/frontend/css/layout.css
	48	+
	49	+	# Secrets and credentials. The baseline every repo under ~/Code carries, kept
	50	+	# identical so no repo is the one that forgot. Suffix-matched rather than
	51	+	# `*.env`, which would also catch committed environment files that hold no
	52	+	# secrets (sweep systemd/sweep.env). `.env.example` is a tracked template and
	53	+	# is negated back in.
	54	+	.env.*
	55	+	!.env.example
	56	+	*.pem
	57	+	*.key
	58	+	*.p8
	59	+	*.p12
	60	+	*.pfx
	61	+	credentials.json