For BlackRoad-OS-Labs:
Do not commit:
- API keys
- private keys
- tokens
- .env files
- provider credentials
- customer/private data
- generated runtime artifacts with secrets
If a secret is exposed:
- Stop work.
- Rotate or revoke the secret.
- Record what happened without pasting the secret.
- Write a receipt.