diff --git a/.gitignore b/.gitignore
index c92196dcf..0b854c5ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,10 +9,12 @@
 
 # misc
 .DS_Store
+
+# environment files - catch all variations
+.env
+.env.*
 .env.local
-.env.development.local
-.env.test.local
-.env.production.local
+.env.*.local
 
 npm-debug.log*
 yarn-debug.log*
@@ -35,7 +37,6 @@ claude-flow.log
 .frigg-infrastructure-cache.json
 .frigg-infrastructure-lock
 
-.env
 .npmrc
 .autorc
 /.nx/
diff --git a/packages/devtools/.npmignore b/packages/devtools/.npmignore
new file mode 100644
index 000000000..4fc23daaf
--- /dev/null
+++ b/packages/devtools/.npmignore
@@ -0,0 +1,15 @@
+# Test files
+test/
+
+# Dev config
+.eslintrc.json
+
+# Environment files - never publish these
+.env
+.env.*
+.env.local
+.env.*.local
+*.env
+
+# Changelog (optional, can be included if desired)
+CHANGELOG.md
diff --git a/packages/devtools/infrastructure/domains/shared/utilities/base-definition-factory.js b/packages/devtools/infrastructure/domains/shared/utilities/base-definition-factory.js
index e350da93a..d39afd9d3 100644
--- a/packages/devtools/infrastructure/domains/shared/utilities/base-definition-factory.js
+++ b/packages/devtools/infrastructure/domains/shared/utilities/base-definition-factory.js
@@ -81,7 +81,13 @@ function createBaseDefinition(
             'node_modules/serverless-kms-grants/**',
             // Note: DO NOT exclude serverless-http - it's a runtime dependency!
 
-            // Exclude local dev files
+            // Exclude local dev files and environment files (NEVER deploy .env files!)
+            '.env',
+            '.env.*',
+            '.env.local',
+            '.env.*.local',
+            '**/.env',
+            '**/.env.*',
             'deploy.log',
             '.env.backup',
             'docker-compose.yml',
@@ -124,6 +130,14 @@ function createBaseDefinition(
             'node_modules/@friggframework/core/node_modules/**',
             'node_modules/@friggframework/devtools/node_modules/**',
 
+            // Exclude environment files (NEVER deploy .env files!)
+            '.env',
+            '.env.*',
+            '.env.local',
+            '.env.*.local',
+            '**/.env',
+            '**/.env.*',
+
             // Exclude development/test files from backend project
             'coverage/**',
             'test/**',
diff --git a/packages/devtools/package.json b/packages/devtools/package.json
index d54b31dda..aab301c99 100644
--- a/packages/devtools/package.json
+++ b/packages/devtools/package.json
@@ -5,6 +5,13 @@
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
+  "files": [
+    "frigg-cli/",
+    "migrations/",
+    "management-ui/dist/",
+    "index.js",
+    "README.md"
+  ],
   "dependencies": {
     "@aws-sdk/client-cloudformation": "^3.705.0",
     "@aws-sdk/client-ec2": "^3.835.0",