# Environment / secrets — NEVER commit real credentials
.env
.env.*
!.env.example

# Composer
/vendor/
composer.lock

# Runtime-generated / local
/storage/logs/*
!/storage/logs/.gitkeep
/storage/cache/*
!/storage/cache/.gitkeep
/storage/sessions/*
!/storage/sessions/.gitkeep
/storage/framework/*
!/storage/framework/.gitkeep

# User-uploaded content — never belongs in version control
/uploads/*
!/uploads/.gitkeep
!/uploads/avatars/.gitkeep
!/uploads/attachments/.gitkeep
!/uploads/imports/.gitkeep
!/uploads/tmp/.gitkeep

# OS / editor cruft
.DS_Store
Thumbs.db
.idea/
.vscode/
*.swp

# PHPUnit / testing artifacts
/.phpunit.cache
/coverage/
