gitignore: untrack 2 .env.local files (leaked Shopify + Anthropic tokens)

86f9d0566abcb8b118b6f0e1175e95087d5a1fdb · 2026-05-30 20:22:27 -0700 · SteveStudio2

DW-Programming/.env.local was a symlink to ../.env (gitignored real file).
DW-Websites/GrassclothWallpaper.com/.env.local held a LIVE Shopify Admin
token in HEAD. Both surfaced by today's prod-side hardcoded-secrets audit.

Stops forward re-leaking on every clone. Secrets remain in history — that's
rotation's job (P0 queue), separate from this structural fix. File contents
stay on disk in working tree.

Per project CLAUDE.md: "Never commit sensitive data — use .gitignore and
environment variables."

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore

Diff

commit 86f9d0566abcb8b118b6f0e1175e95087d5a1fdb
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 20:22:27 2026 -0700

    gitignore: untrack 2 .env.local files (leaked Shopify + Anthropic tokens)
    
    DW-Programming/.env.local was a symlink to ../.env (gitignored real file).
    DW-Websites/GrassclothWallpaper.com/.env.local held a LIVE Shopify Admin
    token in HEAD. Both surfaced by today's prod-side hardcoded-secrets audit.
    
    Stops forward re-leaking on every clone. Secrets remain in history — that's
    rotation's job (P0 queue), separate from this structural fix. File contents
    stay on disk in working tree.
    
    Per project CLAUDE.md: "Never commit sensitive data — use .gitignore and
    environment variables."
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitignore b/.gitignore
index 4ae686f6..3bbd05ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,10 @@
 node_modules
 .env
+.env.local
+.env.*.local
+.env.*
+!.env.example
+!.env.sanitized
 
 # Standing-rule additions (2026-05-07)
 tmp/

← e9a4650a security: pickup DW-Agents strip of hardcoded DW2025secure D · back to Designer Wallcoverings · snapshot before sheets-updater key purge 521e8edc →