# Secrets — NEVER commit
.env
.env.*
!.env.example
*.local
*.local.json
/tokens/
/credentials/
/sessions/
*.cookie
*.session

# Node
node_modules/
npm-debug.log
yarn-error.log
pnpm-debug.log
.npm
.yarn

# Build output
dist/
build/
out/
*.tsbuildinfo
.tsup/

# Test / coverage
coverage/
.nyc_output/
*.lcov

# OS
.DS_Store
Thumbs.db

# Editor
.vscode/
.idea/
*.swp
*.swo
*~

# Local CLAUDE memory (NEVER pushed)
.claude/
CLAUDE.md

# Python appmap auto-generated
appmap.yml
tmp/

# Local reverse-engineering scripts (kept out of repo)
/probe_*.mjs
/grep_*.mjs
/csrf_*.mjs
/patch_test.mjs
/real_routes.mjs
/test_*.mjs
/full_re.mjs
/deep_re.mjs
/check_state.mjs
/.backups/
.findings/
