The-transit-Project/SECURITY_PRIVATE_FILES.md

Security: Private Files Exclusion

This document explains which files are kept private and why.

Files Excluded from Git & Docker

Deployment Documentation (Private)

• ADMIN_DEPLOYMENT_SUMMARY.md - Internal deployment status and setup details
• CI_CD_PORTAINER_GUIDE.md - Private CI/CD and Portainer configuration
• DEPLOYMENT.md - Deployment procedures and configuration guidance
• GETTING_STARTED.md - Internal setup instructions
• INTERNAL_*.md - Any file prefixed with INTERNAL_ (pattern-based exclusion)
• SETUP_*.md - Any file prefixed with SETUP_ (pattern-based exclusion)
• DEPLOY_*.md - Any file prefixed with DEPLOY_ (pattern-based exclusion)

Custom Instruction Files (Private)

• .instructions.md - GitHub Copilot custom instructions
• .prompt.md - Custom prompt templates
• .agent.md - Custom agent definitions
• SKILL.md - Custom skill definitions
• copilot-instructions.md - Extended Copilot instructions
• AGENTS.md - Agent configuration

These are kept private to prevent exposure of:

• Development workflow details
• Copilot customization strategies
• Internal coding guidelines and preferences
• Prompt engineering techniques

Private Scripts

• scripts/private/ - Directory for private deployment scripts
• scripts/*.local.* - Local-specific script configurations

Files Included in Public Repo

Public Documentation

• README.md - Main project documentation
• DOCKER_README.md - Docker usage documentation
• admin_ui/README.md - Admin UI documentation
• admin_ui/SCHEDULE_API.md - Public API documentation
• transit_api/README.md - API documentation
• deprecated/README.md - Legacy Flutter bus terminal documentation kept for historical reference

Configuration

• .env.example - Environment variable template (no secrets)
• .gitignore - Git exclusion rules
• .dockerignore - Docker build exclusion rules
• docker-compose.yml - Service composition
• Dockerfile files - Container definitions

Code & Configuration

• All source code in auth_api/, transit_api/, employee_api/, admin_ui/, and the legacy deprecated/ app
• package.json files (no secrets, only dependencies)
• GitHub Actions workflows in .github/workflows/

Environment Variables - NEVER Commit

Always keep the following OUT of git:

• .env - Local environment variables (in .gitignore)
• Database credentials
• JWT secrets
• API keys and tokens
• Private configuration files

Use .env.example as a template and create local .env files for development.

Docker Build Security

All .dockerignore files (root and per-service) ensure that:

1. Sensitive documentation never enters Docker images
2. Private scripts and configs are excluded from builds
3. Only necessary source code and dependencies are included
4. Build artifacts don't leak internal information

GitHub Actions Security

The CI/CD workflow in .github/workflows/docker-build.yml:

• Only builds from specific service directories (auth_api, transit_api, etc.)
• Respects .dockerignore rules
• Uses GitHub secrets for credentials (never hardcoded)
• Does not include workspace documentation in pushed images

Best Practices

1. Before committing: Check that .env is in .gitignore and local files are not staged
2. Before building Docker: Verify .dockerignore files exclude private docs
3. Before pushing images: Confirm no sensitive data is present (docker inspect --format=...)
4. Deployment: Always use environment variables or secrets managers, never embed credentials
5. Documentation: Keep public docs in *.md files, private docs in separately excluded files

Adding New Private Files

To keep new private files out of the repo and Docker:

1. Add pattern to .gitignore:

   MYFILE_*.md
   new_private_thing.*
   

2. Add pattern to .dockerignore (root and per-service):

   /MYFILE_*.md
   /new_private_thing.*
   

3. Verify with:

   git check-ignore -v MYFILE_something.md