diff --git a/.gitignore b/.gitignore
index a5162b2fe..1baedb9c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -158,3 +158,41 @@ veza-backend-api/audio/
 # SELinux policy (local)
 qemu-fusefs.*
 api
+
+# ============================================================
+# Post-audit J1 (2026-04-14) — never recommit this debris
+# ============================================================
+# Go binaries accidentally committed (v1.0.3 → v1.0.4 cleanup)
+veza-backend-api/server
+veza-backend-api/modern-server
+veza-backend-api/seed
+veza-backend-api/seed-v2
+veza-backend-api/encrypt_oauth_tokens
+
+# Coverage reports (generated, never tracked)
+veza-backend-api/coverage*.out
+veza-backend-api/coverage_groups/
+
+# Frontend build/lint/test artifacts
+apps/web/lint_report*.json
+apps/web/tsc*.log
+apps/web/tsc*.txt
+apps/web/ts_*.log
+apps/web/storybook_*.json
+apps/web/debug-storybook.log
+apps/web/build_errors*.txt
+apps/web/build_output.txt
+apps/web/final_errors.txt
+apps/web/*.log
+apps/web/diagnostic-*.log
+apps/web/frontend.log
+apps/web/audit.log
+
+# Backend local logs
+veza-backend-api/backend*.log
+
+# Root audit screenshots (belong in docs/assets/ if needed)
+/audit-*.png
+
+# AI tooling session state (not code)
+.cursor/