Secret Hygiene Guide

Secrets and private data must remain outside Git.

.gitignore protects .env, .env.local, local import folders, private import folders, and local/private CSV/XLSX exports. Do not commit production credentials, customer exports, private import files, provider tokens, or sensitive logs.

External providers such as Gmail, WhatsApp, SMS/Twilio, Google Drive live sync, WooCommerce, and production AI APIs remain unconnected unless a future sprint explicitly approves them.