From 72f1f3d60874fa4351e1b1e0f1d513053746c78b Mon Sep 17 00:00:00 2001
From: Ayobami Adegoke <adegokeayobamiseun@gmail.com>
Date: Sat, 1 Aug 2026 21:21:20 +0100
Subject: [PATCH] test(security): require personal output ignore rules (#271)

---
 tests/test_security_guards.py | 17 +++++++++++++++++
 tools/security_guards.py      |  8 ++++++++
 2 files changed, 25 insertions(+)

diff --git a/tests/test_security_guards.py b/tests/test_security_guards.py
index 7ec094e..fad0a55 100644
--- a/tests/test_security_guards.py
+++ b/tests/test_security_guards.py
@@ -124,6 +124,23 @@ class GitignoreGuardTests(GuardRepoFixture):
         result = run_guards(self.root)
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
 
+    def test_generated_report_rules_are_required(self):
+        # Reports are generated from the user's tracker and application archive,
+        # so losing these ignore rules can expose personal job-search history.
+        sensitive_outputs = ["reports/", "upskill/*.md"]
+        remaining = [
+            rule
+            for rule in security_guards.REQUIRED_IGNORE_RULES
+            if rule not in sensitive_outputs
+        ]
+        self.write_gitignore(remaining)
+
+        result = run_guards(self.root)
+
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("reports/", result.stdout)
+        self.assertIn("upskill/*.md", result.stdout)
+
 
 class GitignoreNegationTests(GuardRepoFixture):
     def test_negation_reincluding_personal_data_fails(self):
diff --git a/tools/security_guards.py b/tools/security_guards.py
index 28400c2..69c9d09 100644
--- a/tools/security_guards.py
+++ b/tools/security_guards.py
@@ -48,6 +48,10 @@ REQUIRED_IGNORE_RULES = [
     # to its own directory, so the state file lands under .claude/skills/... and
     # a repo-rooted rule silently fails to match it.
     "**/job_scraper/seen_jobs.json",
+    "**/job_scraper/notion_sync.json",
+    "**/job_scraper/*.md",
+    "*_BehavioralReport.pdf",
+    "linkedin_Profile.pdf",
     "cv/main_*.*",
     "!cv/main_example.tex",
     # ATS text extractions (/apply step 5d) carry the CV's full text.
@@ -60,8 +64,12 @@ REQUIRED_IGNORE_RULES = [
     "documents/diplomas/**",
     "documents/references/**",
     "documents/applications/**",
+    "documents/postings/**",
     "documents/interview/**",
     "job_search_tracker.csv",
+    "gmail_sync/",
+    "reports/",
+    "upskill/*.md",
 ]
 
 # Negation (re-include) rules the template legitimately ships. .gitignore is