# Build artifacts
/target/

# Environment and secrets
.env
.env.*
!.env.example

# Local config (contains machine-specific paths and secrets)
config/server.toml
config/production.toml

# Certificates (user-provided)
certs/
*.pem
*.key
*.crt

# Docker Compose (machine-specific ports, volumes, env)
docker-compose.yml
docker-compose.override.yml

# Node modules and build output (frontend)
web/node_modules/
web/dist/

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# Diagnostic exports
*.csv
!data/oui.csv

# Spec docs and diagnostics (contain secrets, live locally only)
SpecDocs/
docs/license-key-spec.md
diagnostics/

# Claude
CLAUDE.md
.claude/
docs/ai/

# Codeforge
.codeforge/

# Internal audit tooling — never ship (see audit/README.md)
audit/
