An allow-list cannot silently grow. An exclude-list can.
When the cost of one mistake is publishing real bank data, the deploy step stops being plumbing and becomes a safety boundary.
SEAM's repository sits beside a personal tool holding real bank transactions. Publishing copies a named allow-list into a clean temporary root and aborts if bank-data markers appear anywhere in it, with the publish directory pinned in Netlify config as a second, independent gate.
Most deploys are a sync with an ignore file. That arrangement has a quiet property nobody notices until it matters: the set of published files grows by default. Add a file, and unless someone remembers to exclude it, it ships. The failure is silent, and it happens on the day the person who knew the convention is not the person adding the file.
Invert it and the property inverts with it. An allow-list publishes nothing it was not explicitly told to publish. A new file in the repository is invisible to the deploy until a human names it. You trade a small, recurring cost — updating a list — for the removal of an entire category of accident.
That trade is obviously wrong for a blog and obviously right when a mistake means a stranger reads someone’s bank transactions. Most projects sit between those poles and default to the sync because it is what the tooling hands you.
The second gate matters as much as the first. The allow-list is a script, and scripts can be edited or bypassed under deadline; pinning the publish directory in platform config means the mistake has to be made twice, in two places, by someone who has overruled themselves once already. Controls that share a single failure mode are one control wearing two hats.