server/base_codebase/src/security/path_guard.py

from pathlib import Path

PROTECTED_PATTERNS = (".env", "prod.db", "production.db", ".git/config")


def is_protected_path(path: str) -> bool:
    normalized = Path(path).as_posix().lower()
    return any(pattern in normalized for pattern in PROTECTED_PATTERNS)