diff --git a/.gitignore b/.gitignore
index 82cd0f6..34eb815 100755
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,10 @@ dist-demo/
 
 # tsup temp (mount cannot unlink)
 tsup.config.bundled_*.mjs
+
+# A real .npmrc carries the Gitea registry _authToken — never commit it.
+# This pattern matches the exact filename only, so .npmrc.example (which is
+# meant to be committed) is unaffected.
+# Publishing from a clone: prefer `npm publish --userconfig <path outside the
+# repo>` over writing a token into the working tree at all.
+.npmrc