Secrets & environments (this repo)

API secrets are encrypted in git with dotenvx; the decryption keys live off-device in Dotenv Armor. This is mandatory — a plaintext secret never belongs in a tracked file.

Armor organization and access boundary

Armor access is split across two organizations. Always pass the owning team explicitly when pushing or pulling; never rely on the CLI's personal-team default.

Only production-authorized members and automation tokens belong to kortix-ai-prod. The shared team must not contain either current prod key.

The four environments (local-run secrets)