diff --git a/.gitignore b/.gitignore
index 64c6132..86114e2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,5 +5,8 @@ __pycache__/
 *.pyc
 result
 
+# secrets — credentials, never committed
+.secrets/
+
 # projects scaffolded locally by scripts/create-project.sh are their own repos — not tracked here
 /projects/