# Local secrets — never commit
.env
.env.*
!.env.example

# Optional: full export with show-sensitive (if ever used)
backups/*-sensitive.rsc