diff --git a/.gitignore b/.gitignore
index 7cd853b..e28bd68 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,9 +13,25 @@ yarn-error.log*
 pnpm-debug.log*
 
 
-# environment variables
-.env
-.env.production
+# secrets — never commit (belt-and-suspenders; real creds live outside the repo)
+.env*
+!.env.example
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+*.token
+*.tfvars
+*credentials*
+.git-credentials
+.netrc
+id_rsa*
+id_ed25519*
+*.kubeconfig
+kubeconfig
+*.secret
+secrets.*
 
 # macOS-specific files
 .DS_Store