From 808be3daad72a39071c50b7f59c956234e2023de Mon Sep 17 00:00:00 2001
From: LeoWinston-9596 <leowinston9596@gmail.com>
Date: Tue, 21 Jul 2026 15:39:56 +1000
Subject: [PATCH] fix(privacy): ignore scraper state and interview records at
 any depth (#208)

job_scraper/seen_jobs.json (and notion_sync.json / *.md) were ignored by a repo-rooted pattern, but the job-scraper skill resolves job_scraper/ relative to its own directory, so the state file lands at .claude/skills/job-scraper/job_scraper/ and the rule never matched - publishing every scraped posting with fit scores and skip-reasons on a public fork. Switches to **/-prefixed patterns that match at any depth (the rooted location still matches too, so no regression), and adds documents/interview/** (interview prep names employers, quotes submitted material, and lists the candidate's weak points) - it was never ignored though documents/applications/** was. REQUIRED_IGNORE_RULES updated in lockstep so the security guard stays in sync.

By @LeoWinston-9596 (split from #199). Verified: both nested and root seen_jobs.json now ignored, interview records ignored, guard suite green (17 tests incl. #195's negation checks). Rebased cleanly on current master.
---
 .gitignore               | 12 +++++++++---
 tools/security_guards.py |  6 +++++-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6452b3d..822de2b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,9 +20,12 @@ venv/
 
 # Personal data (never commit these)
 salary_data.json
-job_scraper/seen_jobs.json
-job_scraper/notion_sync.json
-job_scraper/*.md
+# Match at any depth: the job-scraper skill resolves `job_scraper/` relative to
+# its own directory, so these land at .claude/skills/job-scraper/job_scraper/*.
+# A rooted `job_scraper/...` pattern silently fails to match them.
+**/job_scraper/seen_jobs.json
+**/job_scraper/notion_sync.json
+**/job_scraper/*.md
 *_BehavioralReport.pdf
 linkedin_Profile.pdf
 
@@ -61,6 +64,9 @@ documents/diplomas/**
 documents/references/**
 documents/applications/**
 documents/postings/**
+# Interview prep and experience records: these name the employers applied to,
+# quote what was submitted, and set out the candidate's weak points.
+documents/interview/**
 !documents/**/.gitkeep
 
 # Personal job search tracking
diff --git a/tools/security_guards.py b/tools/security_guards.py
index e9102f6..61a821c 100644
--- a/tools/security_guards.py
+++ b/tools/security_guards.py
@@ -44,7 +44,10 @@ ALLOWED_PERMISSIONS = {
 # Personal-data ignore rules that must never disappear from .gitignore.
 REQUIRED_IGNORE_RULES = [
     "salary_data.json",
-    "job_scraper/seen_jobs.json",
+    # Depth-independent: the job-scraper skill resolves `job_scraper/` relative
+    # to its own directory, so the state file lands under .claude/skills/... and
+    # a repo-rooted rule silently fails to match it.
+    "**/job_scraper/seen_jobs.json",
     "cv/main_*.tex",
     "!cv/main_example.tex",
     "cover_letters/cover_*.tex",
@@ -53,6 +56,7 @@ REQUIRED_IGNORE_RULES = [
     "documents/diplomas/**",
     "documents/references/**",
     "documents/applications/**",
+    "documents/interview/**",
     "job_search_tracker.csv",
 ]