Otty extracts these into your secret store instead of syncing the files. Every generated manager config below leaves them out too.
Not a subtraction from the paths above: this is everything else Incus writes in your home directory that is state, not configuration. It keeps a whole-home manager like chezmoi from sweeping those up, and it still holds if the synced paths are ever widened.
Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.
Opens otty://sync/add/incus. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.
Every one of these keeps all credential files out.