From ef69e97c35f0b71a56521562a647d2802a416b44 Mon Sep 17 00:00:00 2001 From: claudemm Date: Mon, 3 Aug 2026 17:00:32 +0300 Subject: [PATCH] Ignore plain .bak files and run logs; a live key was sitting in one Found on the Mini while checking it for the hole claudeMB found on the MacBook. Different file, same shape. logs/start-all.out was untracked, unignored, and CONTAINED A LIVE xfb_ agent key. `*.log` did not cover it because start-all writes .out. In a clone of a public repo, one `git add -A` publishes it. Alongside it, 14 backup files were equally unignored. The existing `*.bak.*` rule requires a dot AFTER "bak", so it matches "foo.bak.1" and silently does not match plain "foo.bak" anywhere outside config/. The cp-before-edit habit that produced them is a good one - it is the ignore rules that did not match the names it actually produces. Verified against the real filenames rather than invented ones: every one of the 15 is now ignored, and src/, README.md, package.json and bin/ are confirmed still tracked. Deliberately appended rather than edited in place, leaving the existing config block untouched, so this does not collide with #55 (config/*.env). The two are independent and merge in either order. Third instance today of one defect shape: a rule written for one variant, correct for that variant, never extended to its neighbour. thinkoff_green fixed while thinkoff_green_light kept the dark value; config/*.json protecting .json but not .env; *.bak.* protecting foo.bak.1 but not foo.bak. Co-Authored-By: Claude Opus 5 --- .gitignore | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.gitignore b/.gitignore index 163af78..0bfb51e 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,20 @@ config/*.bak* gemini-config.json gemini-config.json.bak* scripts/__pycache__/ + +# Backup copies of edited files. The `*.bak.*` rule above requires a dot +# AFTER "bak", so it matches "foo.bak.1" and silently does NOT match a plain +# "foo.bak" outside config/. Found 2026-08-03: 14 such files sitting untracked +# in a clone of this PUBLIC repo, one `git add -A` from being published. The +# cp-before-edit habit is a good one; it just needs the ignore rules to match +# the names it actually produces. +*.bak +*.bak_* +*-bak +*-bak.* + +# Run logs. `*.log` above does not cover them, because start-all writes .out. +# A log is a plausible place for a key to land: the file that prompted this +# was logs/start-all.out on the Mini, which contained a live xfb_ agent key. +logs/ +*.out