__pycache__/
*.py[cod]
*$py.class
*.so
*.egg-info/
*.egg
dist/
build/
.eggs/
*.whl

.venv/
.env
.env.*
!.env.example
venv/
env/

.pytest_cache/
.coverage
htmlcov/
.tox/
.nox/

*.json
!mcpnuke/data/*.json
# Profiles are hand-written target definitions and belong in the repo. Scan
# output written into the same directory does not — it is large, regenerable,
# and was how 1.3 MB of reports ended up tracked.
!profiles/*.json
profiles/*-scan.json
profiles/*-fast.json
# Slice D offline goldens (minimal findings-only fixtures)
!tests/fixtures/scans/*.json
# Open-source target snapshots (normalized findings, no evidence blobs)
!tests/oss_targets/snapshots/*.json

.mypy_cache/
.ruff_cache/

.DS_Store
*.swp
*.swo
*~

.uv/
tests/test_targets/

# Scan output
walkthrough/report.json

# Implementation plans are local scratch; durable design docs live in docs/specs/
docs/superpowers/plans/

# Secrets — never commit these
**/.*KEY*
**/__KEY*
*.pem
*.key
*.p12
*.pfx
*.crt
*.cer
*.der
*.ovpn
*.kubeconfig
kubeconfig
*.tfstate
*.tfstate.*
*.secret
secrets.*
credentials.*
# Detection patterns, not a credential file. The rule above is path-agnostic
# and would otherwise silently drop this module from commits.
!mcpnuke/patterns/credentials.py
id_rsa
id_rsa.pub
id_ed25519
id_ed25519.pub
.env.local
.env.*.local
