# Deny by default; explicit release-root and recursive source-extension allowlist.
**
!README.md
!AGENTS.md
!LICENSE
!THIRD_PARTY.md
!.gitignore
!.dockerignore
!Dockerfile
!compose.yaml
!Caddyfile
!requirements.lock
!requirements-runtime.lock
!requirements-pure.lock
!requirements-target.txt
!requirements-dev.txt
!app/
!app/**/*.py
!app/latex_sandbox.c
!web/
!web/**/*.js
!web/**/*.mjs
!web/**/*.css
!web/**/*.html
!web/**/*.svg
!web/**/*.json
!web/**/*.webmanifest
!web/**/*.woff2
!web/**/*.png
!web/**/*.ico
!scripts/
!scripts/**/*.py
!scripts/**/*.sh
!tests/
!tests/**/*.py
!tests/**/*.js
!tests/**/*.mjs
!tests/**/*.json
!docs/
!docs/**/*.md
!docs/**/*.json
# Defense in depth after inclusions: no private/cache/vendor subtree.
**/__pycache__/**
**/.pytest_cache/**
**/.mypy_cache/**
**/.ruff_cache/**
**/*.pyc
**/.env
**/.env.*
**/.git/**
**/.venv/**
**/venv/**
**/vendor/**
**/node_modules/**
**/sourceprivate/**
**/private/**
**/secrets/**
**/credentials/**
**/data/**
**/backups/**
**/.local-data/**
**/dist/**
**/target-test-results/**
**/secret.*
**/secrets.*
**/private.*
**/credentials.*
**/*.sqlite*
**/*.db
**/*.anki2
**/*.colpkg
**/*.apkg
**/*.pem
**/*.key
**/*.p12
**/*.pfx
**/*.log
# Only this root example is public; build_release checks empty secret values.
!.env.example
