diff --git a/.gitignore b/.gitignore
index c045736..924df36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,11 @@ dist/*
 /ende
 
 .DS_*
+
+# Local agent/runtime state may contain command logs or pasted context.
+.codex/
+.omx/
+
+# Local keyserver state can include token hashes and operational metadata.
+.ende-keyserver.json
+*.ende-keyserver.json
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7d16f93..f7b8d52 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -34,3 +34,9 @@ If your change affects crypto, key handling, or trust decisions, include:
 - threat model impact,
 - migration/compatibility considerations,
 - validation strategy (tests/manual steps).
+
+## Secret hygiene
+Before committing, run `git status --short` and check that local runtime
+directories, keyserver state files, environment files, and command logs are not
+staged. Do not commit credentials, publish tokens, private keys, or files that
+record local agent sessions.