Config in, state out: databases, WAL/SHM sidecars, caches, logs, sessions, run dirs, ssh-control sockets stay OUT of history. Quarantine list: auth.json, .env, trust.json, private keys never tracked. Pre-commit hook scans staged diff for live-secret shapes (sk-, ghp_, github_pat_, glpat-, xox, AKIA, PEM headers, JWTs) before anything reaches the Gitea remote.