# This repo is public and holds no credential. These patterns are not the
# control that keeps it that way -- `gitleaks detect` over the full history is,
# and it runs with zero allowlist entries. These are here so an accident has to
# be deliberate.

# Anything shaped like a credential
*.age
*.key
*.pem
*_key
*.secret
*_secret
.env
.env.*
!.env.example

# Files the tier boundary says belong elsewhere
private_dot_config/bitwarden/
private_dot_config/gh/hosts.yml
private_dot_config/zsh/secrets.zsh
.chezmoidata/bws.toml

# chezmoi runtime state, never the source
.chezmoistate.boltdb
.chezmoi.toml
!.chezmoi.toml.tmpl

# Picker state and its cached fzf, both machine-local by design
.tests/state/
.tests/fzfver

# OS junk
.DS_Store
**/dot_DS_Store