SA-2026-017: Ignore rules silently dropped files that should have been committed (twice)

What it is

In v0.2.0 a Python .gitignore template ignored the build, gate and release scripts, so they were not in the repository. In v0.5.5 security@'s own rule keys*.json, meant for key files, also matched data/keys.json, so the key register and its page never reached dev.

What an attacker could do

A control that fails silently: the work looks committed and is not. The second time, a security control removed security content.

How: Not an attack: an availability and integrity failure of the release process.

Root cause

A broad ignore pattern, with no check that what the build reads is in git.

What contributed

• git add -A gives no warning for ignored files.
• The author's local copy survived because it was ignored.

What was not in place

A check that every file the build reads is tracked.

The fix

The rule was narrowed (!data/*.json); the scripts were un-ignored.

What prevents it now

Proposed: the gate fails if a file under data/ or admin/build/ exists locally but is ignored.