diff --git a/.gitignore b/.gitignore
index 3c1b716..d4918c6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,8 @@
 __pycache__/
 # Local recorder database (record.py) — dev-only, never committed or deployed.
 data/
+# Secrets — API credentials must never be committed or deployed (server-side only).
+openskycredentials.json
+*credentials*.json
+*.secret
+.env