# canary/ is the intentionally-vulnerable scanner-recall corpus: it must stay
# byte-stable (canary-meta/KEY.md keys findings to its line numbers) and linting
# deliberately-bad code is meaningless, so ruff skips it entirely.
extend-exclude = ["canary"]