diff --git a/.gitignore b/.gitignore
index 163af78..0bfb51e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,20 @@ config/*.bak*
 gemini-config.json
 gemini-config.json.bak*
 scripts/__pycache__/
+
+# Backup copies of edited files. The `*.bak.*` rule above requires a dot
+# AFTER "bak", so it matches "foo.bak.1" and silently does NOT match a plain
+# "foo.bak" outside config/. Found 2026-08-03: 14 such files sitting untracked
+# in a clone of this PUBLIC repo, one `git add -A` from being published. The
+# cp-before-edit habit is a good one; it just needs the ignore rules to match
+# the names it actually produces.
+*.bak
+*.bak_*
+*-bak
+*-bak.*
+
+# Run logs. `*.log` above does not cover them, because start-all writes .out.
+# A log is a plausible place for a key to land: the file that prompted this
+# was logs/start-all.out on the Mini, which contained a live xfb_ agent key.
+logs/
+*.out