glob

git's ** pathspec skips files directly under src/; a four-command throwaway repo exposed the blind spot in a token build gate before anyone exploited it.

TL;DR: While testing a build gate that blocks hardcoded hex colors, I assumed src/**/*.tsx would catch files directly in src. A quick git ls-files experiment proved the pattern misses direct children, leaving a silent loophole. I fixed it by combining shallow and recursive globs and added tests to ensure coverage at any depth.