diff --git a/.gitignore b/.gitignore
index a45bb5e..2af31ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,9 @@ _build
 /test-results/
 /playwright-report/
 .playwright-mcp/
+
+# Local runtime secrets (never commit)
+settings.json
+
+# Local migration/reference repos (not part of app deploy)
+.gitmodules