test(security): require personal output ignore rules (#271)

tests/test_security_guards.py

@@ -124,6 +124,23 @@ class GitignoreGuardTests(GuardRepoFixture):
         result = run_guards(self.root)
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
 
+    def test_generated_report_rules_are_required(self):
+        # Reports are generated from the user's tracker and application archive,
+        # so losing these ignore rules can expose personal job-search history.
+        sensitive_outputs = ["reports/", "upskill/*.md"]
+        remaining = [
+            rule
+            for rule in security_guards.REQUIRED_IGNORE_RULES
+            if rule not in sensitive_outputs
+        ]
+        self.write_gitignore(remaining)
+
+        result = run_guards(self.root)
+
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("reports/", result.stdout)
+        self.assertIn("upskill/*.md", result.stdout)
+
 
 class GitignoreNegationTests(GuardRepoFixture):
     def test_negation_reincluding_personal_data_fails(self):

tools/security_guards.py

@@ -48,6 +48,10 @@ REQUIRED_IGNORE_RULES = [
     # to its own directory, so the state file lands under .claude/skills/... and
     # a repo-rooted rule silently fails to match it.
     "**/job_scraper/seen_jobs.json",
+    "**/job_scraper/notion_sync.json",
+    "**/job_scraper/*.md",
+    "*_BehavioralReport.pdf",
+    "linkedin_Profile.pdf",
     "cv/main_*.*",
     "!cv/main_example.tex",
     # ATS text extractions (/apply step 5d) carry the CV's full text.
@@ -60,8 +64,12 @@ REQUIRED_IGNORE_RULES = [
     "documents/diplomas/**",
     "documents/references/**",
     "documents/applications/**",
+    "documents/postings/**",
     "documents/interview/**",
     "job_search_tracker.csv",
+    "gmail_sync/",
+    "reports/",
+    "upskill/*.md",
 ]
 
 # Negation (re-include) rules the template legitimately ships. .gitignore is