From 1e5ae46d407678d56c59fef66299cd991a6ba5d4 Mon Sep 17 00:00:00 2001
From: lhyliu <liuhaoyang702@gmail.com>
Date: Thu, 7 May 2026 00:28:45 +0800
Subject: [PATCH] Harden secret file ignore rules

---
 .gitignore             | 11 +++++++++++
 tests/test_examples.py | 13 +++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/.gitignore b/.gitignore
index 5c8104c..af07a14 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,14 @@ dist/
 *.egg-info/
 
 *.log
+
+# Local secrets and credentials
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+*.pfx
+secrets.*
+*_secret.*
diff --git a/tests/test_examples.py b/tests/test_examples.py
index 19f7929..ce18761 100644
--- a/tests/test_examples.py
+++ b/tests/test_examples.py
@@ -13,6 +13,7 @@ ROOT_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
 EXAMPLES_DIR = os.path.join(ROOT_DIR, "examples")
 PYPROJECT_PATH = os.path.join(ROOT_DIR, "pyproject.toml")
 LICENSE_PATH = os.path.join(ROOT_DIR, "LICENSE")
+GITIGNORE_PATH = os.path.join(ROOT_DIR, ".gitignore")
 
 
 class ExampleWorkflowTests(unittest.TestCase):
@@ -95,6 +96,18 @@ class ExampleWorkflowTests(unittest.TestCase):
         self.assertEqual(comfy["PublisherId"], "lhyliu")
         self.assertEqual(comfy["DisplayName"], "ComfyUI LLM API")
 
+    def test_local_secret_files_are_ignored(self):
+        with open(GITIGNORE_PATH, "r", encoding="utf-8") as handle:
+            ignored_patterns = set(
+                line.strip()
+                for line in handle
+                if line.strip() and not line.lstrip().startswith("#")
+            )
+
+        for pattern in (".env", ".env.*", "*.key", "*.pem", "secrets.*"):
+            with self.subTest(pattern=pattern):
+                self.assertIn(pattern, ignored_patterns)
+
 
 if __name__ == "__main__":
     unittest.main()