Configure .gitignore to prevent API key commits

[Copilot]

Repository contains scripts that use Etherscan API keys via command-line args or environment variables. No protection existed against accidentally committing API key files.

Changes

.gitignore - Added patterns for API key files:

• Extension-based: *apikey.{txt,json,env}, *api-key.{txt,json,env}, *api_key.{txt,json,env}
• Dotfiles: .apikey, .apikeys, .env.apikey
• Etherscan-specific: etherscan.apikey, etherscan-apikey.{json,txt}
• Collection files: apikeys.json, api-keys.json, api_keys.json
• Local overrides: config.local.json, *.local.json

Documentation - Added security guidance:

• ETHERSCAN_TOKEN_BALANCE.md: Security best practices section with three recommended approaches (environment variables, local config files, CLI args)
• README.md: Security note with link to detailed guidance

Pattern Design

Patterns are specific to file extensions and known API key naming conventions to avoid false positives. Files like api_key_validator.py or test_apikey_handler.js remain tracked.

Existing config files (etherscan-api-config.json, blockchain-address.json) continue to be tracked as they contain no secrets.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.