diff --git a/.gitignore b/.gitignore
index a3bc641..d19be07 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,7 @@
 /target
 config.toml
+# Local operator notes — may contain real uplink secrets. Never commit.
+*.local.md
 
 fedserv.db.jsonl