.secretlintignore

# Aligned with biome.json's excludes so secretlint scans the same source
# surface. .gitignore is respected by default (like biome's vcs.useIgnoreFile),
# so node_modules / dist / .output / .cache need no entry here. These are the
# tracked-but-generated or vendored paths biome also skips:

# Vendored upstream source (git subtrees) — not ours; noisy and slow.
docs/repos/**

# Generated, not hand-written.
**/routeTree.gen.ts
**/locales/**/messages.js

# Lockfile holds integrity hashes, not secrets.
pnpm-lock.yaml

# Local dev mailbox may contain magic-link tokens (also gitignored).
**/.dev-inbox/**

# NOTE: unlike biome, we intentionally still scan package.json, migrations,
# and .claude/settings.local.json — biome skips those for formatting, but a
# leaked secret there is exactly what this gate must catch.