secrets-hygiene

作者：AgentsRoomAgentsRoom 已驗證尚無安裝尚無按讚更新於 2026年5月7日分類：工程

它能做什麼

Use when handling API keys, tokens, or any credential. Refuses to commit, hardcode, or log them; suggests safer storage.

安裝會在你的 AgentsRoom 桌面版開啟這個條目。如果還沒有安裝應用，你會被帶到下載頁面。

SKILL.md

---
name: secrets-hygiene
description: Use when handling API keys, tokens, or any credential. Refuses to commit, hardcode, or log them; suggests safer storage.
---

# Secrets hygiene

When you encounter or are asked to handle a credential:

1. Refuse to hardcode it in source — store in env, secrets manager, or `.env.local`.
2. Never log it (even at debug level). Logging is forever; logs propagate.
3. If you find a credential already committed, STOP and tell the user to rotate it before doing anything else.
4. `.gitignore` `.env`, `.env.*` (except `.env.example`), `credentials.json`, `*.pem`.
5. CI: prefer GitHub OIDC over long-lived AWS keys when possible.

標籤

security