secret-handling

Use pre-commit secret-management policies to block agents from reading .env files and writing credentials to git commit history. This prevents sensitive environment variables from being exposed in version control logs.

Data redaction during automated commits is best handled by enforcing prohibitions on direct secret reads and prompting for credentials only when explicitly required. This approach prevents live credentials from entering repository logs or commit history.

Yes, you can safely read .env.example or .env.template files to understand config schema without exposing live secrets. This security policy recommends these safe alternatives over directly accessing sensitive environment files.

Yes, this secret-management policy applies to all repository interactions including automated reads, commits, logs, and generated decisions across development teams. It enforces prohibitions on direct secret reads and requires safe alternatives before config details are accessed.

You need a security policy because automated agents can inadvertently read .env files and expose secrets by writing them to commit history or logs. Enforcing prohibitions on direct secret reads ensures no live credentials are leaked during development workflows.

Configure pre-commit hooks by enforcing validation, redaction, and user prompts before config details are accessed. This ensures credentials are only requested when explicitly required and are scrubbed from generated logs and commit history.