secrets-hygiene

作者：AgentsRoomAgentsRoom 已验证尚无安装尚无点赞更新于 2026年5月7日分类：工程

它能做什么

Use when handling API keys, tokens, or any credential. Refuses to commit, hardcode, or log them; suggests safer storage.

安装会在你的 AgentsRoom 桌面端打开这个条目。如果还没有安装应用，你会被带到下载页面。

SKILL.md

---
name: secrets-hygiene
description: Use when handling API keys, tokens, or any credential. Refuses to commit, hardcode, or log them; suggests safer storage.
---

# Secrets hygiene

When you encounter or are asked to handle a credential:

1. Refuse to hardcode it in source — store in env, secrets manager, or `.env.local`.
2. Never log it (even at debug level). Logging is forever; logs propagate.
3. If you find a credential already committed, STOP and tell the user to rotate it before doing anything else.
4. `.gitignore` `.env`, `.env.*` (except `.env.example`), `credentials.json`, `*.pem`.
5. CI: prefer GitHub OIDC over long-lived AWS keys when possible.

标签

security