# Node (Tailwind CSS build)
node_modules/

# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# Virtual Environment
venv/
venv*/
.venv/
env/
ENV/

# Application specific
# SECURITY: Never commit settings.json - may contain API tokens and secrets
settings.json
data/settings.json
cloudflare.ini
certificates/
data/
logs/
*.pem
*.key
*.crt
*.csr
letsencrypt/
.secrets/

# Environment files
.env
.env.local
.env.production

# IDE
.vscode/
.idea/
*.swp
*.swo

# OS
.DS_Store
Thumbs.db

# Logs
*.log

# Backup files. Anchored to the repository root: unanchored, `*_backup.*`
# also matched tests/test_backup.py, which therefore existed on disk for
# months without ever being committed or run in CI.
/*_old.*
/*_backup.*

# Planning and development documents
NEXT_FEATURES.md
PLAN_2.0.md
PLAN_*.docx

htmlcov/
.pytest_cache/
.coverage
coverage.xml
test_results.json

# Local dev / debug scripts (kept on developer machines only)
debug_*.py

backups/
app.py.backup

.claude/
test_screenshots/

# Ad-hoc test scripts with real credentials, written at the repository root.
# Anchored (leading /) on purpose: unanchored, `test_api_*.py` swallowed
# tests/test_api_key_expiry_and_masking.py — a committed-looking test file
# that git silently refused to track, so it protected nothing in CI.
/test_real_cert_*.py
/test_api_*.py
/test_certificate_creation_*.py
/real_world_test_*.py
/integration_test_*.py
github_response.md

# local
PLAN.md
scratch/
test_settings.py
# Internal audit docs (not for distribution)
UI_AUDIT.md
UI_SHOTS_ANALYSIS.md

# Theme migration screenshot baseline (regenerated by scripts/theme_baseline.py)
theme-baseline/
UI_DRACONIAN_ANALYSIS.md
UI_UX_Opinioni_CertMate.pdf
UI_REDESIGN_PLAN.md
