chore(repo): Add AI agent security protections for sensitive files (#7580)

Author: jacekradko

.changeset/quick-breads-follow.md

@@ -0,0 +1,2 @@
+---
+---

.claude/settings.json

@@ -0,0 +1,27 @@
+{
+  "disableBypassPermissionsMode": true,
+  "permissions": {
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)",
+      "Read(./**/credentials.json)",
+      "Read(./**/*.pem)",
+      "Read(./**/*.key)",
+      "Read(./**/.keys.json)",
+      "Edit(./.env)",
+      "Edit(./.env.*)",
+      "Edit(./secrets/**)",
+      "Edit(./**/credentials.json)",
+      "Edit(./**/*.pem)",
+      "Edit(./**/*.key)",
+      "Edit(./**/.keys.json)",
+      "Bash(cat .env:*)",
+      "Bash(cat **/credentials.json:*)",
+      "Bash(cat **/*.pem:*)",
+      "Bash(cat **/*.key:*)",
+      "Bash(cat secrets/**:*)",
+      "Bash(cat **/.keys.json:*)"
+    ]
+  }
+}

.cursorignore

@@ -0,0 +1,20 @@
+# AI Agent Security - Sensitive Files
+# These files should never be read by AI tools to prevent
+# accidental exposure of secrets to AI service providers.
+
+# Environment files
+.env
+.env.*
+
+# Secrets directory
+secrets/
+
+# Credentials
+**/credentials.json
+
+# Private keys
+**/*.pem
+**/*.key
+
+# Integration keys
+**/.keys.json

.geminiignore

@@ -0,0 +1,23 @@
+# AI Agent Security - Sensitive Files
+# These files should never be read by AI tools to prevent
+# accidental exposure of secrets to AI service providers.
+#
+# NOTE: Gemini CLI may still read these files if explicitly instructed.
+# See: https://github.com/google-gemini/gemini-cli/issues/13385
+
+# Environment files
+.env
+.env.*
+
+# Secrets directory
+secrets/
+
+# Credentials
+**/credentials.json
+
+# Private keys
+**/*.pem
+**/*.key
+
+# Integration keys
+**/.keys.json

.gitignore

@@ -104,3 +104,6 @@ scripts/.env
 
 # Personal Claude prompt
 CLAUDE.local.md
+
+# Claude Code local settings (user-specific permissions)
+.claude/settings.local.json