From d6f5e7d7a56975db92330ae65159aeef3b8232cb Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Thu, 4 Jun 2026 11:35:32 -0400
Subject: [PATCH] fix: ignore all .env.* secret variants, not just bare .env

Bare `.env` only matched the exact filename, leaving .env.spike / .env.local
and other secret variants untracked-but-committable. Ignore .env.* and re-include
.env.example so the template stays tracked.
---
 .gitignore | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 31fd267..0d566cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,8 +5,11 @@ node_modules/
 dist/
 .dist/
 
-# Environment — NEVER commit .env (secrets at rest: DB passwords, OIDC secrets, encryption key)
+# Environment — NEVER commit secrets at rest (DB passwords, OIDC secrets, encryption key,
+# Fastmail app passwords). Ignore .env and every .env.* variant, but keep the example template.
 .env
+.env.*
+!.env.example
 
 # Editor
 .vscode/