# X_IMAGE_SECRET_UNIGNORED

## Means

a `*.dockerignore` in this tree excludes `.env` and `.npmrc` but not `.secrets.key`, or a Dockerfile has no ignore file at all — no `<Dockerfile>.dockerignore`, no `.dockerignore` at or above it

## Typical cause

the build stage's `COPY . .` then bakes the AES master key into a layer beside the committed `secrets.enc.json` it decrypts, and `findMasterKey` reads the key FILE whenever `ULTIMATE_SECRETS_KEY` is unset — so the container boots on the baked key and the platform's key is never exercised, while `wiki/CLI-Reference.md` promises an image that "ships no key file at all". All four ignore files carried the `.env` block and none carried this line

## Fix

`bun run scripts/image-contract.ts --json` — the `fix` names the file; add `**/.secrets.key` beside its `.npmrc` line

[CLI and verify](/error-codes#cli-and-verify)