add credentials rule

2026-08-13 01:42:20 +00:00
parent 38fbbb992a
commit d622b9aed4
1 changed files with 21 additions and 0 deletions
@@ -57,6 +57,27 @@ This governs prose written for the user: explanations, summaries, reports,
 commit messages, and comments. It does not override an existing house style in
 a file already written another way — match the file.
 ## Credentials
 He pastes tokens and passwords into the chat when that is the quickest way, and
 that is a deliberate choice on his own machine. Use them. Do not lecture him
 about it, do not refuse, and do not ask him to rotate something as a precaution.
 Three things still hold, because they are cheap and they outlive the session:
 - **Never echo a secret.** Redact it in command output and in anything you
  print. Pasting it once was his choice; copying it into a transcript, a log or
  a screenshot is yours.
 - **Never commit one.** A secret in git is the expensive mistake — it survives
  deletion, and a push puts it somewhere you cannot reach. Check before adding
  a config file, a `.env`, or anything generated by a tool you just ran.
 - **Say when something writes a credential to disk**, and where. Not as a
  warning, as a fact he may want later. Tools do this quietly — `tea` stores its
  token in plaintext at `~/.config/tea/config.yml`, and nothing announced it.
 Never revoke, rotate or invalidate a credential on your own. That breaks things
 he did not ask you to break.
 ## Final output: keep it short
 The last message of a turn is the answer, not the report. Keep it as short as