chore: harden .gitignore with security-sensitive file patterns

[gn00295120]

Summary

Add exclusions for credential files, private keys, environment files, and other sensitive patterns that should never be committed.

Patterns added

Pattern	Purpose
.env / .env.*	Environment variable files with secrets
*.pem / *.key / *.p12 / *.pfx	TLS/SSL key material
*.jks / *.keystore	Java keystores
.npmrc / .netrc	Package registry and network credentials
*_rsa / *_ed25519 / *_ecdsa	SSH private keys
credentials.json	NemoClaw credential store
DRAFT-*.md	Security disclosure drafts
.claude/	Claude Code worktrees and local agent state

Context

A comprehensive git history audit (399 commits, all branches, reflog, stashes, GitHub Actions logs) confirmed no secrets were ever committed. However the current .gitignore has no exclusions for these sensitive file types, increasing the probability of a future accidental commit as the contributor base grows.

Test plan

• Verified no tracked files match the new patterns
• git status shows no unintended changes

Summary by CodeRabbit

• Chores
  • Updated project configuration to exclude sensitive files and credentials from version control, including environment variables, certificates, API keys, and local development artifacts.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates .gitignore to exclude sensitive files including environment variables, cryptographic keys, certificates, SSH keys, credential files, draft documents, and local Claude Code state directories.

Changes

Cohort / File(s)	Summary
Configuration .gitignore	Added ignore patterns for environment variables (.env*), cryptographic material (*.pem, *.key, *.p12, *.pfx, *.jks, *.keystore), credential files (.npmrc, .netrc, credentials.json), SSH keys (*_rsa, *_ed25519, *_ecdsa), draft markdown files (DRAFT-*.md), and local Claude Code state (.claude/).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Secrets tucked away, now safe from sight,
Keys and tokens hidden from the light,
With patterns woven through gitignore's keep,
Your credentials rest in slumber deep,
A warren of safety, snug and tight!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding security-sensitive file patterns to .gitignore to prevent accidental commits of credentials and private keys.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.gitignore (1)

14-14: Consider allowing committed env templates while keeping secrets ignored.

Line 14 (.env.*) also ignores safe templates like .env.example/.env.sample, which teams often commit for onboarding.

Suggested `.gitignore` refinement

 .env
 .env.*
+!.env.example
+!.env.sample

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.gitignore at line 14, The current .gitignore line '.env.*' also blocks safe
templates; update the ignore rules so secrets remain ignored but template files
are allowed: stop using a broad '.env.*' pattern and instead explicitly ignore
runtime/secret files (e.g., .env, .env.local, .env.*.local) while whitelisting
common templates by adding negation entries for '.env.example' and '.env.sample'
(and any other project-specific template names); modify the .gitignore to
reflect these specific ignores and negations so onboarding templates can be
committed but secrets remain excluded.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.gitignore:
- Line 14: The current .gitignore line '.env.*' also blocks safe templates;
update the ignore rules so secrets remain ignored but template files are
allowed: stop using a broad '.env.*' pattern and instead explicitly ignore
runtime/secret files (e.g., .env, .env.local, .env.*.local) while whitelisting
common templates by adding negation entries for '.env.example' and '.env.sample'
(and any other project-specific template names); modify the .gitignore to
reflect these specific ignores and negations so onboarding templates can be
committed but secrets remain excluded.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b19ce282-f0b3-4034-a664-61de420b3fe7

📥 Commits

Reviewing files that changed from the base of the PR and between 1dbf82f and bb94594.

📒 Files selected for processing (1)

• .gitignore

[cv]

Thank you!