diff --git a/.gitignore b/.gitignore
index 9acc410..8720553 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,13 +34,13 @@ __pycache__/
 venv/
 env/
 
-# Environment / secrets — app secrets only in backend/.env (never commit it).
-# Root .env is a Compose pointer (COMPOSE_ENV_FILES) with no secrets; keep it.
-backend/.env
+# Environment / secrets — NEVER commit real .env files
+.env
+**/.env
 .env.*
-!.env
+**/.env.*
 !.env.example
-!backend/.env.example
+!**/.env.example
 !frontend/.env.development
 !frontend/.env.production
 
@@ -66,4 +66,3 @@ Utopia-ai-hr-ats-portal 1.pem
 # Local-only Compose overrides (never deployed)
 docker.local.env
 tests/**
-**/.env**
\ No newline at end of file