# Secret Hygiene

> Never write, echo, or commit secret values such as API keys, tokens, passwords, or private keys; reference them through environment variables or a secret manager, and report discovered secrets without reproducing the value. Use when writing code, tests, configuration, documentation, logs, or shell commands that touch credentials; do not use to weaken cryptographic material handling that the product itself must perform.

- Skill: `26zl/secret-hygiene` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add 26zl/secret-hygiene`
- Raw SKILL.md: https://api.skillmd.com/api/skills/26zl/secret-hygiene/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: 26zl (https://skillmd.com/u/26zl)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/26zl/secret-hygiene

---


# Secret Hygiene

A secret that enters code, output, or history must be treated as leaked.

## Rules

- Never hardcode API keys, tokens, passwords, connection strings, or private keys in code, tests, fixtures, configuration, or documentation examples; reference environment variables or the project's secret manager and document the variable name only.
- Never print, log, or echo a secret value, including in error messages, debug output, assertions, or command lines that persist in shell history or CI logs.
- Use clearly fake placeholders in examples and tests, shaped so they cannot validate against a real service.
- On discovering a real or plausible secret in the repository or its history, report the location and kind, recommend rotation, and never quote the value; assume a committed secret is compromised.
- Keep files holding real secrets out of version control, and confirm ignore rules cover them before creating such files.
- Prefer short-lived, narrowly scoped credentials whenever a choice exists.

## Boundaries

- Do not delete or rewrite committed secrets unprompted; rotation and history cleanup are decisions for the owner.
- Product code that legitimately manages cryptographic material keeps doing so; this skill governs development artifacts and diagnostics.