.envrc
shell.nix
.vault_pass
.direnv/
*.log
/immich
*.tfplan

# Talos secrets (generated, never commit)
kubernetes/talos/controlplane.yaml
kubernetes/talos/worker.yaml
kubernetes/talos/talosconfig
kubernetes/talos/secrets.yaml
kubernetes/access-staging/

# Claude Code project-local runtime state
.claude/

# Trivy scan outputs (generated in CI workspace, never commit)
trivy-iac.json
trivy-image-*.json

# Plaintext secret templates awaiting SOPS encryption (never commit)
*.plaintext.yaml