updated the sheet

.gitignore

@@ -49,3 +49,22 @@ app.*.map.json
 # every failing run — 128 of them were sitting untracked. The references
 # themselves live in test/shots and ARE committed; these are the diff output.
 test/failures/
+
+# ── Signing material never goes in the repo ──
+#
+# `android/key.properties` holds the keystore passwords in plain text and the
+# `.jks` files are the signing keys themselves. Anyone with both can publish an
+# update to the app under its own identity, so a copy in git is a copy in every
+# clone, every fork and every CI cache, for as long as the history exists.
+#
+# The keys that were already committed (nearlerider-keystore.jks,
+# release-key.jks) are unused — the app signs with a key generated outside the
+# repo — but they are still in the history and should be treated as public.
+# They are left tracked deliberately: removing them from the working tree does
+# not remove them from history, and rewriting history is the repo owner's call.
+#
+# Keep the keystore and its passwords in a password manager or a CI secret
+# store. Losing them means never being able to update the app on Play again.
+android/key.properties
+*.jks
+*.keystore