# instructions for agents
.github/instructions/
.agents
skills-lock.json

# environment variables
.env

# python cache
__pycache__/
.mypy_cache/

# python virtual environment
.venv/

# app runtime data (feeds, caches, scan state - regenerated each run).
# All of this must stay UNTRACKED so ``git pull`` never conflicts with files a
# scan has written since the last pull (see .github/instructions/DEPLOYMENT.md).
# The single allowed tracked seed is the read-only PaloAlto scanner-ips.txt
# (never rewritten at runtime); the Cloudflare ips-*.txt are runtime-refreshed
# downloads, so they are NOT tracked and are re-downloaded if absent.
app/data/*
!app/data/paloalto/scanner-ips.txt

# SQLite database (canonical store) + WAL/SHM sidecars
app/data/*.db
app/data/*.db-wal
app/data/*.db-shm

# generated reports
app/reports/