# Secrets and local configuration
# A bare pattern matches at any depth, so this covers infrastructure/.env too.

# TLS material. The local-db overlay generates a self-signed pair inside the
# postgres volume, but nothing stops someone dropping certs here by hand.
*.pem
*.key
*.crt

# Structural snapshots taken before destructive migrations
krowdb_public_snapshot_*.sql

# Go build output
/go-api/bin/
*.test
*.out

# Editor / OS
.DS_Store
.idea/
.vscode/

# Filled-in Kubernetes secret (the .example is the committed template)
infrastructure/k8s/10-secret.yaml

# Database exports. Real tenant data — password hashes, personal details.
# Generated by `make export-data`; move it over scp, never through git.
seed/exports/