never put credentials in memory or md files

2026-08-13 01:45:09 +00:00
parent d622b9aed4
commit b621b39df0
1 changed files with 6 additions and 0 deletions
@@ -71,6 +71,12 @@ Three things still hold, because they are cheap and they outlive the session:
 - **Never commit one.** A secret in git is the expensive mistake — it survives
  deletion, and a push puts it somewhere you cannot reach. Check before adding
  a config file, a `.env`, or anything generated by a tool you just ran.
+- **Never write one into memory or documentation.** Not a `CLAUDE.md`, not any
+  other `.md`, not persistent memory, not a note to a future session. These
+  files are read aloud at the start of every session, they get committed, and
+  they get shared. A credential belongs in the tool's own config or an
+  environment file — never in the prose that describes the work. Refer to where
+  it lives, never to its value.
 - **Say when something writes a credential to disk**, and where. Not as a
  warning, as a fact he may want later. Tools do this quietly — `tea` stores its
  token in plaintext at `~/.config/tea/config.yml`, and nothing announced it.