No secrets in git

A short always-on rule so the agent never commits credentials, writes them into source, or treats a token pasted in chat as something to store.

Lives in .cursor/rules and shapes how the agent works.

Install path

.cursor/rules/no-secrets.mdc

---
description: Never commit secrets, credentials, or tokens — treat chat pastes as leaked
alwaysApply: true
---

# No secrets in git

Credentials do not belong in the repository, in committed snapshots, or in files the next agent will read.

## Never commit

- API tokens, PATs, `.env`, private keys, connection strings with passwords
- Cloud provider secrets, webhook signing secrets, session secrets
- “Temporary” credentials in fixtures, screenshots, or README samples

## If a token appears in chat

Treat it as leaked. Use it only if the user asked for a one-time action (deploy, ingest). Do not write it to disk, to git, or into a kit. Remind them to rotate it.

## Substitutes

- Local or mock fallbacks when the feature can run without the real secret
- Named env vars in docs (`VERCEL_TOKEN`), never values
- Example values that cannot authenticate (`sk_test_placeholder`)

## If a secret is already in git

Stop. Do not keep building on top of it. Remove it from the working tree and say that rotation and history rewrite are still required.