From 945d8b40a667954d28ab355eb195eab54c65f1b6 Mon Sep 17 00:00:00 2001
From: Lcos <3349888061@qq.com>
Date: Tue, 21 Jul 2026 18:02:58 +0800
Subject: [PATCH] fix(gitignore): ignore .env files at any level, keep
 .env.example templates

The documented setup flow creates a real .env at the repo root (cp .env.example .env) but only deploy/.env was ignored, so root-level secrets could be committed by accident. Replace the single-path rule with .env / .env.local / .env.*.local at any level; tracked .env.example templates are unaffected.
---
 .gitignore | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index e946f6b7..ee97c977 100644
--- a/.gitignore
+++ b/.gitignore
@@ -94,8 +94,13 @@ deploy/nginx/ssl/*.crt
 deploy/nginx/ssl/*.key
 deploy/nginx/ssl/*.pem
 
-# Deploy env
-deploy/.env
+# Env files (real secrets - do not commit)
+# .env matches any level; .env.example / *.env.example are templates and stay tracked.
+.env
+.env.local
+.env.*.local
+!.env.example
+!**/.env.example
 
 # Claude Code local settings
 CLAUDE.md