Keep secrets out

• Approved coding tools can read your source code. That's the point. Secrets, production data and customer records are a different matter.
• Working for yourself? Your client contracts and the accounts you pay for set these rules. A client's code is covered by your contract with them.
• Keep .env files and keys out of the agent's context. Use placeholder values in examples, and fake data in tests.
• Logs and error output often contain tokens, emails and IDs. Redact them before pasting.
• If a secret ever reaches a prompt, a commit or a chat, rotate it. Deleting the message isn't enough.