diff --git a/.gitignore b/.gitignore
index e9eefed..b518b64 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,37 @@
 .DS_Store
+node_modules/
+
+# Secrets — never commit real credentials, keys, or tokens.
 .env
 .env.*
 !.env.example
-node_modules/
+.envrc
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+*.jks
+*.keystore
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+id_ecdsa
+id_ecdsa.*
+*.token
+credentials.json
+credentials*.json
+service-account*.json
+secrets.json
+secrets*.json
+.netrc
+.npmrc
+*.tfvars
+!.tfvars.example
+.terraform/
+*.tfstate
+*.tfstate.*
 .wp-env/
 vendor/
 dist/