diff --git a/.gitignore b/.gitignore
index d990a5e..4f0cdd0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,9 @@ node_modules/
 .pytest_cache/
 .ruff_cache/
 .mypy_cache/
+
+# LNbits writes its runtime data folder next to the CWD on import, including
+# .lnbits_auth_key — a real instance secret. Importing this package (a test
+# run, a REPL) is enough to create it. Never track it.
+data/
+.lnbits_auth_key