chore: committed profile export (default.tar.gz) removed from repo root and Docker layers (salvage #91712)

[teknium1]

Summary

default.tar.gz — a full profile export accidentally committed to the repo root in ee37f3d8976b — is no longer in the tree or in Docker image layers. Salvages the removal from #91712 by @EAbaracus (authorship preserved), with the exposure vectors closed on top.

The tarball contained a populated platforms.webhook.extra.secret (48-hex, webhook.enabled: true) and a secrets.bitwarden.project_id in its config.yaml, so this is security-relevant cleanup, not just tree hygiene: .dockerignore had no matching pattern, meaning the Dockerfile's COPY . . layer carried the archive into every published image since v2026.8.19.

Changes

• Cherry-picked from chore/docs: cleanup committed root artifacts + minor docs/diagnostics fixes #91712 (@EAbaracus): delete default.tar.gz (1.9 MB), log.txt, sqlite_leak_fix.png; add .gitignore rules (HA-D11-001 / HA-D3-001)
• .gitignore: anchor the new rules to repo root (/log.txt, /default.tar.gz, …) per review feedback so same-named test fixtures at depth aren't silently ignored
• .dockerignore: add the same set plus /*.tar.gz so root archives can never reach an image layer again

Validation

	Before	After
default.tar.gz in tree	yes (1.9 MB, contains live-looking webhook secret)	removed
.dockerignore matches it	NONE	/default.tar.gz, /*.tar.gz
Repo references to the file	tests write it to tmp dirs only — nothing reads from repo root	unchanged

Note: removal from the working tree does not purge the blob from history (ee37f3d8976b remains reachable) — secret rotation and image republish are handled separately.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on b19deeb — chore: add contributor email mapping for EAbaracus}

⚠️ Warnings

OSV vulnerability scan · View job

7 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json
• CVE-2026-71554 in uv.lock

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 2m40s vs 3m27s (-22.7%). 7 job(s) slower, 5 faster,

• OS-specific tests / Windows-only tests: -42.0s
• Python tests / Run tests: +19.0s
• OS-specific tests / macOS-only tests: +7.0s
• Detect affected areas: +6.0s
• Python tests / e2e: +5.0s

[andrexibiza]

Post-merge incident settlement is now owned by #92457. Keep #92394 as the merged source-tree/Docker-context prevention authority; do not reopen or fork that cleanup into another removal PR.

#92457 owns the remaining distinct predicates: rotate/revoke the exposed webhook credential at its real authority, establish the affected image/tag window, republish or retire distributed images that could contain default.tar.gz, and make an explicit Git-history decision for the still-reachable ee37f3d8976b blob. Exposure is established; malicious use is not asserted.

Provenance from #91712 / @EAbaracus remains attached to the artifact-removal lineage through #92394.