/target
/tmp

# local secrets — never commit (a pushed key is permanently compromised)
.env