# Python
__pycache__/
*.py[codz]
*$py.class
*.so
*.egg-info/
*.egg
dist/
build/
.Python
MANIFEST

# Virtual environments
.venv/
env/
venv/

# Testing & coverage
.pytest_cache/
htmlcov/
.coverage
.coverage.*
coverage.xml

# Type checkers & linters
.mypy_cache/
.ruff_cache/
.pytype/

# IDEs
.idea/
.vscode/

# Frontend
frontend/node_modules/
frontend/dist/
# openapi.json is a transient build artifact — TS types are generated from it
# and committed, but the raw schema isn't worth tracking.
frontend/openapi.json
# Per-module bundle attribution, written only by CTFY_BUNDLE_STATS=1 builds
# (see frontend/scripts/perf/README.md). Regenerated on demand and churns
# with every chunk hash, so it is a report, not a source file.
frontend/perf-bundle-stats.json
# tsc incremental build cache; churns on every build and adds noise to diffs.
frontend/tsconfig.tsbuildinfo

# Playwright e2e artefacts. The curated webms in docs/videos/ are
# committed as project assets; the per-test results dir + the HTML
# report are ephemeral.
frontend/test-results/
frontend/playwright-report/

# `capture_corpus_shots.py` writes a tour recording beside the PNGs it
# is run for. Nothing references it — unlike docs/videos/, which is a
# curated set — so it was untracked *and* unignored, i.e. one `git add
# -A` from a 1 MB binary nobody asked for. Same shape as the C2O
# seeder's params output.
docs/screenshots/*.webm

# Frontend build output (all historical paths)
ctfy/dashboard/static/
ctfy/server/static/
llm_pentest_bench/server/static/
pentest/server/static/

# Generated SDK reference (pdoc output, built at wheel time from
# docstrings). Shipped as a wheel artifact and mounted at
# /sdk-docs/ on the server; never committed.
ctfy/server/sdk_docs/

# Environment & secrets
.env
.envrc
.pypirc

# uv
# uv.lock is committed for reproducibility

# Data & runtime artifacts
data/results/
*.sqlite3
*.sqlite3-*
*.log

# Docker
docker-compose.override.yml

# OS files
.DS_Store
Thumbs.db

# Cloudflare Wrangler CLI cache (account id, local state)
.wrangler/

# Data files
data/
# Source-controlled reference data ships with the frontend bundle
# (ISO 3166-1 country codes, IANA timezone helpers, …).
!frontend/src/data/

# Sandbox-environment-specific egress proxy CA bundles. The
# ``mitmproxy`` image build picks up any ``*.crt`` files dropped
# here, but the certs themselves are env-specific and never check
# into source control.
mitmproxy/extra-ca-certs/*.crt
!mitmproxy/extra-ca-certs/.gitkeep

# Compose overrides the C2O docker e2e fixtures write at stack-up and
# unlink in their ``finally``, so each exists on disk only mid-run — or
# after a run that was killed. Globbed rather than listed: there are
# two today and one per app thereafter, and the next one would arrive
# untracked and unignored like these did. In that state a leftover
# reads as work in progress, which is how one came to be committed by a
# ``git add -A`` and separately "restored" from history on the belief
# that a test had deleted a tracked file.
ctfy/tests/*_e2e_override.yml

# The Node 24 toolchain CLAUDE.md tells contributors to extract here —
# the image ships 22 and .nvmrc wants 24. 205 MB of vendor binaries;
# ignored rather than left untracked so a `git add -A` cannot commit it.
/node-v*-linux-x64/
node.tar.xz
