1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
/target
# Runtime artefacts written into the WORKING DIRECTORY by the documented
# defaults. These are ignored because the defaults are relative paths, so a
# `cargo run` or a `./featherreader` from a clone writes them straight into the
# repo — and one of them is a private key.
# The confidential client's ES256 signing key (FEATHERREADER_OAUTH_KEY_PATH,
# default `oauth-signing-key.json`). It holds the private scalar. It is
# encrypted at rest only when FEATHERREADER_OAUTH_ENCRYPTION_KEY is set, so on a
# misconfigured run this file is a plaintext private key sitting in the repo
# root. Never commit it.
/oauth-signing-key.json
*.jwk.json
# The disposable SQLite cache (FEATHERREADER_DB, default `featherreader.db`) and
# its WAL/SHM siblings. Disposable, but it also holds the `oauth_session` table
# — access tokens, refresh tokens and per-session DPoP keys.
/featherreader.db
/featherreader.db-shm
/featherreader.db-wal
# The Node sidecar's own store and signing key (SIDECAR_DB), same reasoning.
/oauth-sidecar.db
/oauth-sidecar.db-shm
/oauth-sidecar.db-wal
# Local env files. The committed examples are `.env.example`; anything else is
# someone's real configuration.
.env
.env.*
!.env.example
# Claude Code's per-checkout local settings (tool permissions, model choice).
# Personal to whoever is working here, and `settings.json` is the committed
# shared form if one is ever wanted.
/.claude/settings.local.json