Read credentials from the current process environment, a system keychain, or a local environment file excluded by Git. Keep committed .env.example files limited to empty variable names and documentation.

Check whether a variable exists without printing its value. Keep credentials out of source files, Markdown, JSON, generated HTML, screenshots, issues, commits, shell history, and command arguments. Redact authorization headers, cookies, tokens, signed URLs, and credential-bearing query parameters from diagnostic output.

Rotate a credential immediately when it has been committed or exposed.

Store the evidence needed for the current growth question. Respect platform terms, user consent, privacy obligations, copyright, and retention requirements. Keep sensitive exports and operational Memory in ignored local paths or a private system selected by the user.