secret-handling

To prevent credential leaks, you can configure agents to never read real .env files directly. This ensures live credentials are never exposed in logs, decisions, or history by relying on safe placeholders.

The best way to keep secrets out of committed files is to prohibit reading real .env files and replace them with .env.example references. This prompts users for needed config details while ensuring credentials are never written to committed files.

You can validate commits by applying pre-commit checks that block secrets from being written to .squad/ directories and logs. This provides remediation guidance to prevent credential leakage across CI workflows and automation tasks.

Yes, this secret handling approach applies across repository access, CI workflows, and automation tasks. It enforces safe secrets handling by requiring safe placeholders and pre-commit checks to keep live secrets confidential.

You should use .env.example files because reading real .env files risks accidental credential exposure. Safe placeholders ensure configuration details are provided by the user without writing live secrets into committed files or agent history.

When a secret is accidentally written to .squad/, pre-commit validation checks detect the secret leakage and provide remediation guidance. This prevents the credential exposure from persisting in committed files or logs.