diff --git a/.gitignore b/.gitignore
index c45f93c..703a41f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,5 +51,8 @@ docker-compose.override.yml
 # Filesystem storage backend root (FilesystemBackend default location)
 /storage/
 
+# Private credentials + forensic captures — never commit
+/private/
+
 # Local berth-PDF + brochure samples used as upload fixtures during dev.
 /berth_pdf_example/