Security: the never-commit guarantee (secrets, credentials, .storage/, addon runtime files) now holds for migrated repos too — not just ones the add-on bootstrapped. Patterns are enforced via .git/info/exclude on every run, and any secret a prior run already committed is untracked (removal flows out through the next backup PR). Previously a repo migrated in with its own .gitignore lacking these entries could leak an OAuth token (.google.token) or key.