Protect sk- keys
- Never commit keys to public repos or ship them in frontend bundles
- Prefer env vars / secret managers
- Rotate immediately if leaked
- Separate keys for dev/stage/prod
Two credential surfaces
Do not mix them casually.
Hygiene
- Limit automation tokens to required models/groups
- Never log full secrets
- Use
<token>placeholders in shared examples