18 lines
869 B
Markdown
18 lines
869 B
Markdown
# Development credential policy
|
|
|
|
Codex may use credential helpers already configured on the machine, but must not expose or persist their secrets.
|
|
|
|
Allowed discovery:
|
|
- `git credential` / Git Credential Manager as invoked by Git;
|
|
- Docker credential store as invoked by Docker;
|
|
- environment variables explicitly supplied to the task/runtime;
|
|
- sibling project files only to learn endpoint names, secret variable names and deployment conventions.
|
|
|
|
Not allowed without a new explicit user instruction:
|
|
- recursive searching for plaintext passwords/tokens in unrelated repositories;
|
|
- printing recovered credentials;
|
|
- copying a literal secret from one project into this repository;
|
|
- committing `.env.local`, Portainer keys, Gitea tokens or passwords.
|
|
|
|
If Git push or Portainer deployment still needs credentials, ask the user for the minimal credential/API key needed.
|