The bare repo runs with status.showUntrackedFiles=no, so this is not about
quietening git status - it guards against an absent-minded "config add" over a
home directory full of credentials. It does not stop "config add -f"; nothing
here protects against intent.
mailsecrets.py is listed because that is the existing pattern: the waybar mail
module imports its IMAP credentials from it, and the file has never been
committed. That has held so far by discipline alone.
Private keys are excluded and public ones re-included. Verified with
check-ignore rather than assumed - reading its exit code alone is misleading,
since a matching negative pattern also exits 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
