secure-api-keys-and-secretslisted

Keys start in a `.env` because that is what works on day one. Then nobody can say how many copies exist. ## Diagnose Start with evidence from the code itself. In the repository: ```bash npx @trustycap/cli productionize --json ``` The scanner reads the route handlers with the TypeScript compiler API and classifies each against the published production standard (`GET https://api.trustycap.com/v1/production/requirements`): file and line, AST evidence, a classification (`CONFIRMED_FAIL`, `PROBABLE_GAP`, `UNKNOWN`, `PASS`), the provider-neutral requirement, the implementations that satisfy it, and the exact commands. `UNKNOWN` is not a failure; read the code it points at rather than installing over it. A requirement the project already satisfies another way is declared in `trustycap.production.json`. - Is a `.env` committed, or in the history? Check the history, not just the working tree: a removed file is still in the log. - Are there credential literals in source, in CI configuration, or in a deploy script? - Could the builder answer, right now, every place a given key is deployed? If not, they cannot rotate it quickly, which is exactly when speed matters. **If a key is already exposed, rotation at the provider comes first.** Moving an exposed key into a vault does not un-expose it. ## Fit, and not for **Not for** storing end users' passwords, which should not be stored at all. Hash them and never hold the original. **Not for** configuration that is not secret; a feature