T3MP3ST public launch build

.gitignore

@@ -0,0 +1,57 @@
+node_modules/
+dist/
+.env
+*.tsbuildinfo
+
+# --- excluded from the published repo ---
+# raw upstream Cybench corpus (181M third-party content incl. writeups/flags/solutions — do not redistribute)
+bench/cybench/corpus-stage/
+# ephemeral docker staging (regenerated each run)
+bench/cybench/service-stage/
+# per-challenge staging dirs (contain flag.expected answer files; regenerable)
+bench/cybench/challenges/
+# XBOW/XBEN staging (1.3G third-party challenge source + .env flag files; regenerated by xbow-bench.mjs)
+bench/xbow/stage/
+bench/xbow/challenges/
+# robustness fallback dirs + artifact unpacks (regenerable)
+**/*.stale-*
+**/release_unpacked/
+# secrets / creds (belt-and-suspenders)
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+# logs + python caches + os cruft
+*.log
+**/__pycache__/
+.DS_Store
+
+# --- coordinated-disclosure HOLD (never publish unpatched vuln detail) ---
+# Structured findings, executed PoCs/reproducers, generated disclosure packages,
+# and reporting guidance stay LOCAL until each bug is fixed/disclosed with its
+# vendor. The *tooling* that makes them (disclosure-gen, verify-finding) is
+# tracked; its *outputs* — and any reproducer code or compiled PoC binary — are not.
+# Entire wild-hunt tree = unreported-vuln hunt output (structured findings, executed
+# PoCs, generated disclosure dossiers, the results/ campaign summaries, GATE-PRECISION).
+# NONE of it ships until each bug is vendor-coordinated. The *tooling* lives in src/ +
+# scripts/; only its *outputs* live here, so ignoring the whole tree is safe (0 tracked).
+bench/wild-hunt/
+docs/disclosures/
+# Held planning docs that reference unreported vulnerabilities (pre-disclosure)
+docs/V6_PLAN.md
+
+# decomposition run artifacts (reports may contain unreported vulnerability analysis)
+bench/decomposition-results/
+
+# refusal-frontier raw responses can contain model-written toy-exploit text
+bench/refusal-frontier/
+bench/nyu/
+
+# local one-off key paste file (Venice etc.) — never commit
+.keys.local
+# bounty platform API credentials — never commit
+.keys.bounty.json
+# sensitive export leak-gate denylist (operator handle + embargoed disclosure
+# targets + personal vault) loaded by the exporter — never commit
+scripts/.export-denylist.local