# Secrets — never commit tokens, keys, or credentials.
*.token
*.key
*.pem
*id_rsa*
*id_ed25519*
.env
.env.*
**/secrets/
**/*secret*
!config/**/secrets*.example

# 1Password / auth material some machines keep alongside dotfiles.
.config/op/
op/*.token

# Editor / tool junk.
*.swp
*.swo
*~
.DS_Store
.netrwhist

# Shell/session state that must stay per-machine.
.zsh_history
.zcompdump*
.cache/

# Neovim local/session artifacts.
config/nvim/.luarc.json
**/undodir/

# Backups written by install.sh (kept under $HOME, never in-repo, but
# ignore defensively in case one is ever created inside the checkout).
.dotfiles-backup/