diff --git a/.gitignore b/.gitignore
index 99b449a..30248f1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,7 @@ get-pip.py
 hf_cache/
 infrastructure/deploy.ps1
 infrastructure/terraform/tfplan
+
+# Secrets: never commit environment files (env was leaked publicly on 2026-10-19)
+env
+.env*