---
description: Never expose or hard-code secrets
alwaysApply: true
---

- Read secrets from environment variables. Never write a real key, token or password into code, tests, docs or examples.
- Client-exposed prefixes (`NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_`) are public. Never put a secret behind one.
- Calls to paid or secret-key APIs go through server code, never directly from the browser.
- Never log tokens, cookies, auth headers or whole `process.env` / `os.environ` objects.
- When adding a variable, add a dummy entry to `.env.example` and make sure `.env*` (except the example) is git-ignored.
- If you spot a secret already committed, stop and tell the human that it needs rotating with the provider.