Record

UR-07

Status

superseded by D-09

Built

a standing rule

Decided

2026-09-28 by the coordinator

Secrets from the environment only

Keys, tokens and passwords are read from the environment (or the credential vault once it exists), never from a tracked file, and never written into a tracked file, a report, a log, a brief or a test fixture; a fixture that needs a key-shaped value builds one that no scanner or provider accepts.

Superseded by D-09: this rule came from the first friction audit (FR-28) and was adopted by the coordinator, not the user, and its product clause contradicted the database key file (D-15) and the credential vault (CRED-DIR).