diff --git a/.gitignore b/.gitignore
index f5d9e55..bc8b930 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,34 @@
 node_modules/
 dist/
 *.tgz
+
+# OS
 .DS_Store
+Thumbs.db
+
+# Editor / IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Planning artifacts (internal, not shipped)
+docs/superpowers/
+
+# Config / secrets
+.env
+.env.*
+*.pem
+*.key
+
+# Debug / logs
+*.log
+npm-debug.log*
+
+# Cache
+.cache/
+*.sqlite
+
+# Build artifacts
+*.tsbuildinfo
diff --git a/CLAUDE.md b/CLAUDE.md
index d389723..8634089 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -57,6 +57,14 @@ git push origin main
 gh pr comment <number> --body "Merged, thanks!"
 ```
 
+### What gets committed
+- Source code: `src/`, `tests/`
+- Config: `package.json`, `tsconfig.json`, `tsup.config.ts`, `.gitignore`
+- Docs: `README.md`, `CHANGELOG.md`, `LICENSE`, `CLAUDE.md`
+- Assets: `assets/`
+- NEVER commit: `.env`, secrets, keys, planning docs (`docs/superpowers/`), IDE config, logs, `.DS_Store`
+- Check `git status` before every commit. Stage specific files, never `git add -A` or `git add .`
+
 ### Commit rules
 - Commits from: AgentSeal <hello@agentseal.org>
 - NEVER add Co-Authored-By lines