1 files changed, 28 insertions, 1 deletions

diff --git a/.env.example b/.env.example
index 0789b28..993399a 100644
--- a/.env.example
+++ b/.env.example
@@ -227,4 +227,31 @@
 #   NGIT_REPOSITORY_WHITELIST=bitcoin-core,linux,rust
 # Note: Cannot be used with NGIT_ARCHIVE_READ_ONLY=true (mutually exclusive)
 # Note: When set, NIP-11 curation field will indicate curated repository acceptance
-# NGIT_REPOSITORY_WHITELIST=
\ No newline at end of file
+# NGIT_REPOSITORY_WHITELIST=
+
+# ============================================================================
+# REPOSITORY BLACKLIST
+# ============================================================================
+
+# Blacklist specific repos/pubkeys/identifiers to reject
+# Comma-separated list supporting three formats (same as whitelist formats):
+#   <npub>              - Block all repos from this pubkey
+#   <npub>/<identifier> - Block specific repo
+#   <identifier>        - Block repos with this identifier (any pubkey)
+#
+# Blacklist takes precedence over ALL whitelists:
+#   - Blacklisted repos are rejected even if they match archive or repository whitelists
+#   - Blacklisted repos are rejected even if they list our service
+#
+# Rejection reasons indicate the match type:
+#   - "Repository owner <npub> is blacklisted" (npub format)
+#   - "Repository <npub>/<identifier> is blacklisted" (npub/identifier format)
+#   - "Repository identifier <identifier> is blacklisted" (identifier format)
+#
+# CLI: --repository-blacklist <list>
+# Default: (empty - no repositories are blacklisted)
+# Examples:
+#   NGIT_REPOSITORY_BLACKLIST=npub1spam...
+#   NGIT_REPOSITORY_BLACKLIST=npub1alice.../bad-repo
+#   NGIT_REPOSITORY_BLACKLIST=malware-repo,spam-repo
+# NGIT_REPOSITORY_BLACKLIST=
\ No newline at end of file