# Files excluded from the release ZIP.
# Follows the wp-cli dist-archive convention (one pattern per line).

# Dev artifacts
.git
.gitignore
.distignore
node_modules
*.log

# Operator-private context (never publish)
CLAUDE.md
.env
.env.local

# Astro docs site (full project lives inside docs/ — exclude from plugin ZIP)
docs

# Keep the security audit reports — they're trust signals for an auth plugin:
# - SECURITY_AUDIT_REPORT.md
# - FINAL_SECURITY_AUDIT_REPORT.md
# - OAUTH2_RFC_COMPLIANCE_AUDIT.md
# - SECURITY_IMPLEMENTATION_GUIDE.md