security: add comprehensive .gitignore and fix workflow security scans

- Add comprehensive .gitignore with security patterns for sensitive files
- Fix security scan in CI workflow to avoid false positives
- Add patterns for keys, certificates, environment files, and credentials
- Improve hardcoded credential detection accuracy
- Ensure no sensitive files are accidentally committed

Resolves critical security audit findings and enhances repository security.

Author: uldyssian-sh

.github/workflows/ci.yml

@@ -60,19 +60,20 @@ jobs:
       run: |
         echo "🔍 Scanning for sensitive data..."
         
-        # Check for potential sensitive data patterns
-        if grep -r -i "password\|secret\|key\|token" --include="*.ps1" --include="*.md" .; then
-          echo "⚠️ Potential sensitive data found. Please review."
+        # Check for actual hardcoded credentials (not just keywords)
+        if grep -r -E "(password|secret|key|token)\s*[:=]\s*['\"][a-zA-Z0-9]{8,}['\"]" --include="*.ps1" --include="*.md" . | grep -v -E "(example|placeholder|template|sample|test|YOUR_|EXAMPLE_)" | grep -q .; then
+          echo "❌ Hardcoded credentials detected!"
+          exit 1
         else
-          echo "✅ No sensitive data patterns detected."
+          echo "✅ No hardcoded credentials found."
         fi
         
-        # Check for hardcoded credentials
-        if grep -r -E "(username|password)\s*=\s*['\"][^'\"]+['\"]" --include="*.ps1" .; then
-          echo "❌ Hardcoded credentials detected!"
+        # Check for real sensitive file patterns
+        if find . -name "*.key" -o -name "*.pem" -o -name ".env" | grep -q .; then
+          echo "❌ Sensitive files detected!"
           exit 1
         else
-          echo "✅ No hardcoded credentials found."
+          echo "✅ No sensitive files found."
         fi
 
   documentation-check:

.gitignore

@@ -0,0 +1,99 @@
+# Security - Sensitive Files
+*.key
+*.pem
+*.p12
+*.pfx
+*.crt
+*.cer
+
+# Environment Files
+.env
+*.env
+.env.local
+.env.production
+.env.staging
+
+# Configuration Files
+config.json
+secrets.json
+settings.json
+appsettings.json
+
+# Credentials
+credentials.json
+auth.json
+token.json
+
+# PowerShell Profiles
+Microsoft.PowerShell_profile.ps1
+profile.ps1
+
+# Logs
+*.log
+logs/
+*.log.*
+
+# Temporary Files
+*.tmp
+*.temp
+temp/
+tmp/
+
+# IDE Files
+.vscode/settings.json
+.vscode/launch.json
+.idea/
+*.swp
+*.swo
+*~
+
+# OS Files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Build Artifacts
+bin/
+obj/
+dist/
+build/
+out/
+
+# Package Files
+*.zip
+*.tar.gz
+*.rar
+*.7z
+
+# Backup Files
+*.bak
+*.backup
+*.old
+
+# Test Results
+TestResults/
+*.trx
+*.coverage
+
+# Node.js (if applicable)
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Python (if applicable)
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+env/
+venv/
+ENV/
+
+# PowerShell Modules Cache
+PSGetModuleInfo.xml