# The compose build context is the repo root (deploy/ uses context: ..).
# Keep secrets and local cruft OUT of the image: COPY . would otherwise bake
# them into a layer recoverable via `docker history` / `docker save`.
deploy/secrets/
secrets/
**/*.env
.env
.env.*
.venv/
.git/
.github/
dist/
**/__pycache__/
*.egg-info/
.security-local/
docs/SECURITY_RESIDUALS.md
.mypy_cache/
.ruff_cache/
.pytest_cache/
