The .gitignore rule `secrets/` matched any directory named secrets/ anywhere in the tree, including the new lib/secrets/ application code that holds the AES-GCM helpers. Production build failed with "Module not found: Can't resolve '@/lib/secrets/crypto'". Anchor the ignore to the repo root with `/secrets/` so only the top-level credentials directory is excluded.