nexum-shield/.gitignore at main · Shuchi-Anush/nexum-shield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
# ======================
# GLOBAL
# ======================
.DS_Store
Thumbs.db
*.log

# ======================
# ENV
# ======================
.env
.env.*
!.env.example
!backend/.env.example
!frontend/.env.example

backend/.env
frontend/.env.local

# ======================
# BACKEND (Python)
# ======================
backend/.venv/
backend/__pycache__/
backend/*.pyc
backend/.pytest_cache/
backend/.mypy_cache/

# ======================
# FRONTEND (Next.js)
# ======================
frontend/node_modules/
frontend/.next/
frontend/out/
frontend/build/

# ======================
# BUILD / TEMP
# ======================
dist/
build/

# ======================
# IDE
# ======================
.vscode/
.idea/

# ======================
# LOCAL DEV / PRIVATE — selective tracking per governance migration
# ======================
# Phase-1 persistence model: most of .claude/ is tracked (rules, agents,
# skills, archive, CLAUDE.md, settings.json). Only working-cognition,
# transcripts, active labs, and personal-settings paths stay ignored.
#
# We do NOT blanket-ignore .claude/ — git short-circuits descending into
# excluded directories, which would defeat per-subpath negations.

.claude/memory/
.claude/claude_sessions/
.claude/labs/
.claude/settings.local.json
.claude/settings.json

# Everything else under .claude/ is tracked, including:
#   .claude/CLAUDE.md, .claude/rules/**, .claude/agents/**,
#   .claude/skills/**, .claude/archive/**
#
# .claude/settings.json — currently treated as local/transient until
# governance stabilises further; revisit in a later phase.

# Note: CLAUDE.md (root) and docs/** are NOT ignored — they have no
# matching rule above and are therefore tracked by default. The earlier
# blanket "docs/" and "CLAUDE.md" ignores have been removed.

# ======================
# SECRETS (CRITICAL)
# ======================
# Generic secrets
*.pem
*.key
*.crt
*.p12

# Service accounts / credentials
*service-account*.json
*credentials*.json
secrets/

# Explicit block (extra safety)
backend/gcp-service-account.json

# Allow safe JSON configs explicitly
!package.json
!tsconfig.json
!pyproject.toml
!uv.lock