From 7edd0c055d05e47b70bc6a47f0ca64560b87ae4a Mon Sep 17 00:00:00 2001
From: abrichr <richard.abrich@mldsai.com>
Date: Wed, 26 Aug 2026 17:28:40 -0400
Subject: [PATCH] chore: ignore every .env variant, not one at a time

.gitignore did not cover .env.bak or .env.local. A .env.bak containing
populated API keys was found in a local stash in another repo, untracked
and one `git add -A` from being committed.

Use a glob and negate the committed .env.example template.
---
 .gitignore | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitignore b/.gitignore
index c8f36f6..e92fd54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,8 @@
 # Never-publish workspace material (strategy, prospect research, counsel packs,
 # personal contact details). Created ad hoc; must never reach a remote.
 .private/
+
+# Cover every .env variant, not one at a time. Negate the committed
+# template so it stays tracked.
+.env.*
+!.env.example