diff --git a/hooks/scripts/auto-commit.sh b/hooks/scripts/auto-commit.sh
index 37cf654..4f419cc 100755
--- a/hooks/scripts/auto-commit.sh
+++ b/hooks/scripts/auto-commit.sh
@@ -25,8 +25,9 @@ if ! git rev-parse --is-inside-work-tree &>/dev/null; then
   exit 0
 fi
 
-# Stage all changes
-git add -A 2>/dev/null || exit 0
+# Stage vault directories only — avoid accidentally committing credentials
+# or sensitive files placed outside the vault's knowledge space
+git add notes/ ops/ self/ inbox/ templates/ .arscontexta 2>/dev/null || true
 
 # Check if there are staged changes
 if git diff --cached --quiet 2>/dev/null; then