Generated from corpus/lines/software/units/sw.std.secrets.md. Do not edit by hand — run python scripts/generate-corpus-docs.py.

sw.std.secrets

Status: draft (recovered)
Sources: root AGENTS.md §7; 01 - Pipeline Management/AGENTS.md §9; Lab/Portfolio AGENTS

Guardrails

• Never commit secrets, API keys, or private keys to git.
• Canonical store: Bitwarden Secrets Manager (EU), project workspaces.
• Unlock with secret-gate (_repos/tools/secret-gate/secret-gate.ps1); use cached session when present.
• Prefer generic reusable key names (VPS_SSH_KEY, not my-app-vps-ssh-key).
• Before creating a secret, bws secret list and reuse if suitable.
• New secrets: create placeholder → Hector updates value in vault UI.

Per-repo GitHub Actions secrets (Lab/Portfolio Free-plan orgs)

Secret	Purpose
VPS_HOST	Tailscale IP of deploy host (script may hardcode mesh IP)
VPS_SSH_KEY	Deploy SSH private key
TAILSCALE_AUTHKEY	Tailscale auth for Actions

Set after promotion via add-repo-secrets.ps1 in the same shell as secret-gate.

Prohibited

• Hard-coding tokens in scripts or docs
• Echoing secret values into chat/logs when avoidable