Assistant/development/CREDENTIAL_POLICY.md

Development credential policy

Codex may use credential helpers already configured on the machine, but must not expose or persist their secrets.

Allowed discovery:

• git credential / Git Credential Manager as invoked by Git;
• Docker credential store as invoked by Docker;
• environment variables explicitly supplied to the task/runtime;
• sibling project files only to learn endpoint names, secret variable names and deployment conventions.

Not allowed without a new explicit user instruction:

• recursive searching for plaintext passwords/tokens in unrelated repositories;
• printing recovered credentials;
• copying a literal secret from one project into this repository;
• committing .env.local, Portainer keys, Gitea tokens or passwords.

If Git push or Portainer deployment still needs credentials, ask the user for the minimal credential/API key needed.