hardened .gitignore