diff --git a/.gitignore b/.gitignore
index 45c367a..cb1a450 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,14 @@ ui/dist/
 .lattice-dev/
 *.tar.gz
 *.wasm
+
+# Publisher signing material. `pluginsign` reads a raw 32-byte Ed25519 seed from a
+# file path, so a stray `seed.bin` in the working tree is one `git add -A` away from
+# being published. Never commit key material; keep seeds outside the repo.
+*.key
+*.pem
+*.seed
+seed
+seed.*
+*_seed
+*.bin