diff --git a/.gitignore b/.gitignore
index 9675f38..cc54ce9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,12 @@ build/rootfs-work/
 *.swo
 *~
 
+# Secrets — never commit
+.env
+.env.*
+*.token
+*.pat
+
 # OS
 .DS_Store
 ._*