Navinspire-ia Secrets Manager
Overview
Secrets stay in secret stores or environment variables. Chat history and git are not vaults.
Preferred patterns
- Read from env (
os.environ/ shell env) already configured on the host - Reference Vault / AWS SM / 1Password CLI paths - fetch at runtime, do not cache in markdown
- Use provider Settings in Navin WebUI for API keys when available
- For CI: repository secrets / OIDC - not hardcoded values
Workflow
- Identify which secret is needed and which store holds it.
- Confirm it is not already in the repo (
grepfor key-shaped strings). - Wire the tool/config to the env var name - do not print the value.
- Redact any accidental exposure in your reply (
sk-***,AKIA***). - If a secret leaked into chat or git, tell the user to rotate it.
Forbidden
- Committing
.envwith real values - Putting tokens in
SKILL.mdor memory files - Echoing full secrets in tool arguments visible to the user when avoidable