# Secret handling policy

Secrets stay outside Git, canonical manifests, project knowledge, prompts, logs, and scanner output.

- Detection reports category, count, offsets, and cryptographic hashes only; it never returns a matched value.
- Retrieval does not include secret-bearing content.
- Promotion removes secrets, personal addresses, and supplied client identifiers before a K5 candidate can become K1.
- Installers and ingestion adapters never search for, adopt, copy, or broaden credentials automatically.