Version: 2026-06-05
Summary
- .gitignore protects Git, not the AI context.
- .aiignore or equivalent AI exclusions are mandatory for customer projects.
- Secrets, dumps, logs, backups, production data, and real credentials do not belong in AI context.
- AI project rules should check context boundaries before work starts.
- CI or pre-push checks should verify that AI exclusions and rules exist and were not weakened silently.
Topic
Data and data classes when AI tools are used in everyday development work.
Starting Point
Teams use tools such as ChatGPT, Claude, Codex, OpenAI services, and IDE assistants. These tools are useful because they can read code, summarize project state, generate implementation proposals, and help with tests or documentation.
The same capability creates risk. A repository often contains more than application source code: local configuration, sample credentials, customer-specific exports, logs, backups, migrations, screenshots, or operational notes. Some of this data is ignored by Git and still visible locally.
Risk
If the AI context is not deliberately limited, sensitive files can be submitted to an AI system by accident. The mistake is easy to miss because it does not necessarily change the Git diff.
Recommendation
Treat AI context as its own security boundary. Do not rely on Git settings alone. A project that allows AI assistance needs a visible exclusion file or an equivalent tool-specific mechanism.
The exclusion must cover at least:
- secrets and environment files
- database dumps and exports
- backups and generated archives
- logs with real user or customer data
- production credentials and connection strings
- customer-specific documents that are not required for the task
- local working files outside the repository
The project should also contain short AI rules that tell the assistant to inspect the allowed context before it starts work. This is not a replacement for technical controls, but it reduces casual mistakes.
Practical Rule
A safe setup makes the default small. The AI should see the files needed for the task, not the developer's entire machine, home directory, or unrelated customer projects.
Review Checklist
- Is there a project-specific AI exclusion file or tool configuration?
- Are secrets, dumps, logs, and backups excluded?
- Are local-only files considered, not only versioned files?
- Does the team know which tool can see which files?
- Is weakening the exclusion visible in review?
Wall rules
.gitignore protects Git. .aiignore protects AI context. They are not the same.
Open questions for a project
- Which AI tools are allowed to read project files?
- Which data classes are always forbidden in AI context?
- Which checks should run before push or merge?
- Who approves exceptions?