Skip to content

chore(security): broaden secret exclusions, move publish PAT out of the repo #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jpantsjoha wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(security): broaden secret exclusions, move publish PAT out of the repo #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,17 @@ v6/scripts/
*.temp
.cache/

# Local development & secrets
# Local development & secrets.
# Credentials belong in ~/.config/vscode-publishing/publish.env or the macOS
# keychain, never in a project directory — a repo-local secret is one `git add -A`
# away from being public, and this repo IS public.
.env
.env.local
.env.*.local
.env.*
!.env.example
*.pat
*.token
secrets.json
.npmrc

# Test coverage
coverage/
Expand Down Expand Up @@ -88,3 +95,8 @@ mcp/tradingview-mcp/
# The CI golden corpus lives in test/fixtures/corpus/ (synthetic fixtures) so the
# false-positive gate works without exposing any trading logic. See CLAUDE.md.
examples/

# Working directory — process notes, planning, audits, release runbooks.
# Same convention as _plugin/ in googlecloud-plugin and pinescript-plugin:
# operational detail stays out of the public repo.
_process/
Loading