# Development credential policy

Codex may use credential helpers already configured on the machine, but must not expose or persist their secrets.

Allowed discovery:
- `git credential` / Git Credential Manager as invoked by Git;
- Docker credential store as invoked by Docker;
- environment variables explicitly supplied to the task/runtime;
- sibling project files only to learn endpoint names, secret variable names and deployment conventions.

Not allowed without a new explicit user instruction:
- recursive searching for plaintext passwords/tokens in unrelated repositories;
- printing recovered credentials;
- copying a literal secret from one project into this repository;
- committing `.env.local`, Portainer keys, Gitea tokens or passwords.

If Git push or Portainer deployment still needs credentials, ask the user for the minimal credential/API key needed.