# Release builds accept only application sources and explicit build inputs.
# Local configuration, databases, backups, Git metadata and tool caches must
# never be sent to the builder, even if new directories are added to the repo.
**
!Dockerfile
!.dockerignore
!LICENSE
!backend/
!backend/requirements.txt
!backend/app/
!backend/app/**
!frontend/
!frontend/package.json
!frontend/package-lock.json
!frontend/next-env.d.ts
!frontend/next.config.js
!frontend/proxy.ts
!frontend/tsconfig.json
!frontend/app/
!frontend/app/**
!frontend/public/
!frontend/public/**
!docker/
!docker/supervisord.conf
!docker/requirements-runtime.txt
!data/
!data/branding/
!data/branding/**

# Defense in depth for accidental private/generated files under allowed paths.
**/.env
**/.env.*
**/__pycache__
**/*.pyc
**/*.log
**/*.db
**/*.db-*
**/*.sqlite
**/*.sqlite3
**/bootstrap-admin.json
**/bootstrap-secrets.json
**/.magent-secrets-*
**/node_modules
**/.next