Exclusions that do not open a hole

The steps, in order

1. 1

   Step 1

   Prefer hash or full-path exclusions over file-name exclusions. A name can be reused; a SHA-256 cannot.

2. 2

   Step 2

   For a build folder, exclude the artifacts subfolder, not the project root. The root also contains scripts you do want to see.

3. 3

   Step 3

   Exclusions for the network engine are not inherited from the file engine. They are separate lists on purpose — a URL is not a file.

4. 4

   Step 4

   Review the list once a quarter. A forgotten exclusion is more dangerous than one you remember.