---
description: Secret and environment file safety conventions
globs: .env,**/.env,**/*.env,infra/**/*,**/*secret*,**/*Secret*,**/*credential*,**/*Credential*
alwaysApply: false
---

# Secrets And Env Safety

- Never print, summarize, commit, or expose real secret values, credentials, tokens, private keys, or `.env` contents.
- If env keys are needed for documentation, list only key names and example placeholders, not live values.
- Preserve the existing env/secret flow through root scripts such as `bun run downloadEnv`, `bun run uploadEnv`, `bun run downloadSecret`, and `bun run uploadSecret`.
- When editing infra env or secret scripts, keep Jenkins and deployment assumptions intact unless the task explicitly asks to change them.
- Treat generated env/secret artifacts as sensitive even when they are not named `.env`.