diff --git a/.gitignore b/.gitignore
index 2faf43d..ac54b58 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,72 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+# ---------------------------------------------------------------------------
+# Secrets & local configuration — never commit these to a public repository.
+# Added org-wide 2026-09. See POps-Rox/.github#1
+# ---------------------------------------------------------------------------
+
+# Kubernetes / cluster credentials
+kubeconfig
+kubeconfig.*
+*.kubeconfig
+.kube/
+
+# Private keys, certificates & keystores
+*.key
+*.pem
+*.pfx
+*.p12
+*.jks
+*.keystore
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+*.ppk
+
+# Terraform state & local workspace (state frequently embeds secrets)
+*.tfstate
+*.tfstate.*
+*.tfstate.backup
+.terraform/
+.terraform.lock.hcl.local
+crash.log
+crash.*.log
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+.terraformrc
+terraform.rc
+
+# Environment & local app configuration
+.env
+.env.*
+!.env.example
+!.env.*.example
+local.settings.json
+appsettings.Local.json
+secrets.json
+
+# Cloud CLI / credential caches
+.azure/
+.aws/
+.gcloud/
+azurecreds.conf
+
+# Dependencies & build output
+node_modules/
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+Lib/site-packages/
+pyvenv.cfg
+
+# OS / editor noise
+.DS_Store
+Thumbs.db
+*.swp
+*~