Secret Hygiene

Core rule

A secret should exist only where required, for only as long as required, and never enter generated artifacts or logs by accident.

Contract

• Read credential values from established secret stores/environment/config mechanisms rather than hardcoding.
• Never echo full tokens or authorization headers.
• Redact logs, error payloads, screenshots, diagnostics, and saved reports.
• Exclude .env, credential stores, auth caches, browser profiles, and machine-specific install state from release archives.
• Before publication, scan staged artifacts for common secret patterns and unexpected private files.
• Preserve file permissions where the platform supports them.

Prove presence, never value

Most secret leaks in diagnostics come from an honest question: "is the variable actually set?" Answer it without printing it.