Security

Never track: tokens, keys, OAuth DBs, histories, raw secret-shaped inventory.

Atuin is local-only (auto_sync = false). Do not commit ~/.local/share/atuin/history.db, key, or session. usql named connections / DSNs stay untracked (not in dot_usqlrc).

just secrets-scan
just inventory-redacted   # scrubbed → local/ only

Env names only (.env.example). Absolute /Users/<you>/… out of docs free prose.