# Python
__pycache__/
*.py[cod]
*$py.class
*.egg-info/
*.egg
dist/
build/
.eggs/

# Virtual environments
.venv/
venv/
env/

# IDE
.idea/
.vscode/
# ...but test fixtures deliberately carry .vscode/ configs the ide_task_rce
# scanner reads (AAK-IDE-TASK-001..004). Re-include the directory, then its files.
!tests/fixtures/**/.vscode/
!tests/fixtures/**/.vscode/**
*.swp
*.swo

# Test/Coverage
.pytest_cache/
.coverage
htmlcov/
.tox/
.mypy_cache/
.ruff_cache/

# OS
.DS_Store
Thumbs.db

# Environment
.env
.env.*
# ...but AAK-SECRET-006 only fires on a file named .env or .env.*, so its limitation
# fixtures need one. `.env.example` is the name that is safe to commit: no secret in it.
!tests/fixtures/limitations/**/.env.example

# Claude Code auto-memory
.claude/auto-memory/dirty-files

# Agent Audit Kit cache
.agent-audit-kit/
# ...but test fixtures deliberately carry .agent-audit-kit/tool-pins.json files the
# pin_drift scanner reads (AAK-RUGPULL-001..003). Re-include the directory, then its files.
!tests/fixtures/**/.agent-audit-kit/
!tests/fixtures/**/.agent-audit-kit/**

# Benchmark data (downloaded configs)
benchmarks/data/
benchmarks/results.json
benchmarks/site/

# v0.3.3: cve-watcher persistent state
.aak/cve-watcher-state.json

# Private strategy note — kept locally, never tracked in the public tree
# (removed from tracking 2026-07-28; its own header said "do not commit").
KILL-CRITERIA.md

# Scan output does not belong in version control. findings.sarif sat at the repo
# root as an orphan artifact (referenced by nothing, 8 findings from an old scan)
# that drifted from rules.json on every rule change. SARIF is generated on demand
# (`aak scan --format sarif`) and the GitHub Action uploads it to Code Scanning.
# Root-anchored so the intentional example under examples/case-studies/ is untouched.
/findings.sarif
/*.sarif
