# OS
.DS_Store
Thumbs.db

# 环境变量（保护敏感信息）
.env
.env.local
.env.*.local
.env.development
.env.test
.env.production

# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
.venv/
venv/
ENV/
.eggs/
*.egg-info/
dist/
build/

# Node.js
node_modules/
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# IDE
.vscode/
.idea/
*.swp
*.swo

# 测试
.pytest_cache/
.coverage
htmlcov/

# Cursor
.cursor/
.claude/

# 文档与测试程序
mydoc/
mytest/

# 日志文件
backend/logs/
*.log

# Upload files
backend/uploads/

# Database (contains user accounts and data)
backend/data/
*.db
*.db-shm
*.db-wal

# Docker data
data/

# Test files
test_simulation.pdf
frontend/public/test_simulation.pdf

# Temp/output files
/tmp/

# Database backups — these contain user emails and password hashes.
# NEVER commit them. Take one with ./scripts/backup_production_db_private.sh,
# which writes outside the repository by default and refuses a destination
# inside this worktree.
# Repo-wide, not just backups/: a dump is dangerous wherever it lands. These
# patterns match no tracked file (the tracked backups/ entries are .json).
*.dump
*.backup
backups/*.sql
backups/*.sql.gz
# Generated frontend build output copied into the backend image at build time.
# Never source; it was accidentally staged twice during PR-M2.
backend/static_dist/
