Secrets policy

• Credentials live in a shared password manager vault: TODO: name the tool and vault.
• Two people hold break-glass access.
• Secrets are never committed to Git, pasted into chat, or written in this guide.
• Production and development use different keys.
• A secret scanner runs on every commit (for example gitleaks in CI).
• Rotate on the schedule in the Maintenance calendar, and immediately when someone with access leaves or a key may have leaked.