secret-hygienelisted

# Secret Hygiene The single most expensive class of mistake when generating code is writing a real credential into a file that git tracks. Once a secret is committed it is effectively public — deleting it later does not help, because the value lives in history and must be rotated. Scanners like gitleaks catch this *after* the fact; the job here is to never write the secret in the first place, and to catch it if it slipped in before a commit. Read this whole file when the skill triggers. It is short on purpose. ## The one rule **A real secret never goes into a file that git tracks.** Not in source, not in a config file, not in a `CLAUDE.md`, not in a deploy script, not "just for now to test it." If a value authenticates to something, it lives in an environment variable or a secrets manager, and the tracked file reads it from there. This holds even when the user pastes a real credential and asks to "just hardcode it for now." Hardcoding it is the failure mode that leaks it. Wire it through env instead — it is the same amount of work and it is safe. ## When writing code that needs a secret Never inline the literal. Read it from the environment, and document the variable without giving it a real value. **Python** ```python import os API_KEY = os.environ["OPENAI_API_KEY"] # raises clearly if unset DB_URL = os.environ.get("DATABASE_URL", "") # optional, empty default ``` **Node / TypeScript** ```javascript const apiKey = process.env.OPENAI_API_KEY if (!apiKey) thr