# Default-deny context: deployment secrets and repository metadata never enter COPY.
**
!composer.json
!LICENSE.txt
!AUTHORS.md
!ai_code_review_server.*
!src/
!src/**
!config/
!config/**
!bin/
!bin/run-review-worker.php
!bin/run-bounded-git.php
!bin/git-askpass.php
!bin/resolve-repository-host.php
# Reject secret-like files even below allowed runtime directories.
**/.env
**/.env.*
**/.git
**/*.pem
**/*.key
**/*secret*
