audit-pipeline-cli/.gitignore at main · Copenhagen0x/audit-pipeline-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# Virtual environments
.venv/
venv/
ENV/
env/

# pyenv
.python-version

# Test / coverage
.pytest_cache/
.coverage
.coverage.*
.cache
htmlcov/
.tox/
.nox/
coverage.xml
*.cover
*.py,cover
.hypothesis/

# mypy
.mypy_cache/
.dmypy.json
dmypy.json

# Editor / IDE
.vscode/
.idea/
*.swp
*.swo
*~
.DS_Store

# Audit pipeline workspace artifacts (when invoked locally)
audit_ws/
workspaces/
*.audit-workspace/

# Cryptographic keys — NEVER commit private keys.
# Public keys (.pub) are explicitly re-included so the platform key
# stays publishable for signature verification.
keys/*.ed25519
keys/*.gpg
keys/*.pem
keys/*.key
keys/*.priv
!keys/*.pub
!keys/*.pub.*

# SMTP / runtime secrets
.env
.env.local
deploy/.env
deploy/.env.local
notifier.json
deploy/notifier.json

# Findings DB + scheduler state — workspace-local, not source
findings.db
scheduler.state.json
*.audit-workspace.db

# Cross-cutting audit Defect 12 (LOW): the following used to be missed
# and would leak via a stray `git add -A` from a workspace dir
customers.json
customers/*/keys/*.ed25519   # private keypair material
customers/*/keys/*.pem
.audit-env
*.audit-env
.audit_api_calls.jsonl
.daily_spend.json
.daily_spend.json.lock
hooks/
hunts/*/hooks/
derived/

# Per memory rule "Never edit sent OUTREACH artifacts": OUTREACH/ files
# are frozen historical record. Untracked + ignored so a `git add -A`
# from inside this repo can never silently re-stage them.
OUTREACH/jelleo-funding-proposal-short.html
OUTREACH/jelleo-funding-proposal-short.POLISHED.html
OUTREACH/jelleo-funding-proposal-short.BACKUP-pre-shrink-2026-05-03.html
OUTREACH/jelleo-ottersec-demo-script.html
OUTREACH/jelleo-proposal-glossary.html

# Other artefacts that should never be source-tracked
AUDIT_FINAL_*.md
.claude/
website/index-v1-stable.html

# Generated reports + signatures (rendered per cycle, not source)
reports/
hunts/*/hunt_report.html
hunts/*/*.sig
*.report.md.sig

# ── On-chain program (jelleo-attestation), folded into this repo 2026-05-29 ──
# Key material — RECURSIVE + defense-in-depth. The program ships its own nested
# .gitignore too, but private keys must never rely on a single ignore layer:
**/*keypair*.json
**/*-authority.json
**/keys/*.ed25519
**/secret.txt
**/*.secret
# Rust build output (the multi-MB .so is also matched by *.so above):
**/target/
# Throwaway devnet rehearsal workspace (sqlite DB + scratch hunts) — not source:
**/rehearsal-workspace/