.venv/
__pycache__/
*.py[cod]
*.egg-info/
build/
dist/
.pytest_cache/
.mypy_cache/

# Never commit credentials. .env.example is the template.
.env

# Live masking integration test credentials (`klaxon masking test` and the
# integration/live pytest). Real values go into one of these local files (copy
# from tests/live/.env.example); both are never committed.
.env.live
tests/live/.env

# Deployable masking artifacts embed the real salt (`params.salt`) and are a
# secret store — never commit them. `klaxon masking generate --tenant X
# --out DIR` writes the deployable set into DIR; use an ignored directory.
deployable/
.deploy/

# `klaxon masking deploy` snapshots the CURRENT deployed state (incl. the real
# deployed salt) under tenants/*/generated/backup/ for `--rollback` — a secret
# store, never committed.
tenants/*/generated/backup/

# The anonymization audit log (llm_prompts.log) is a runtime artifact and can
# contain personal data — never commit it. Its export and the compliance report
# are generated on demand.
llm_prompts.log
dsgvo_compliance_report.txt

# Auto-generated HMAC salt files (a secret) next to the config file.
*.salt

# The DSGVO plausibility checker's runtime artifacts: audit log and
# auto-generated compliance report.
gdpr_check.log
gdpr_compliance_report.json

# Personal Claude Code settings; the shared ones belong in .claude/settings.json.
.claude/*.local.json
.claude/
