# Secret Handling

Never read .env files or write secrets to .squad/ committed files

- Repository: https://github.com/microsoft/waza (1496 stars)
- Category: Writing
- License: MIT
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add microsoft/waza --skill secret-handling -g -a claude-code -y`
Codex: `npx skills add microsoft/waza --skill secret-handling -g -a codex -y`
Cursor: `npx skills add microsoft/waza --skill secret-handling -g -a cursor -y`
Gemini CLI: `npx skills add microsoft/waza --skill secret-handling -g -a gemini-cli -y`

## Description

Never read .env files or write secrets to .squad/ committed files

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## Context

Spawned agents have read access to the entire repository, including `.env` files containing live credentials. If an agent reads secrets and writes them to `.squad/` files (decisions, logs, history), Scribe auto-commits them to git, exposing them in remote history. This skill codifies absolute prohibitions and safe alternatives.

## Patterns

### Prohibited File Reads

**NEVER read these files:**
- `.env` (production secrets)
- `.env.local` (local dev secrets)
- `.env.production` (production environment)
- `.env.development` (development environment)
- `.env.staging` (staging environment)
- `.env.test` (test environment with real credentials)
- Any file matching `.env.*` UNLESS explicitly allowed (see below)

**Allowed alternatives:**
- `.env.example` (safe, contains placeholder values, no real secrets)
- `.env.sample` (safe, documentation template)
- `.env.template` (safe, schema/structure reference)

**If you need config info:**
1. **Ask the user directly**, "What's the database connection string?"
2. **Read `.env.example`**, shows structure without exposing secrets
3. **Read documentation**, check `README.md`, `docs/`, config guides

**NEVER assume you can "just peek at .env to understand the schema."** Use `.env.example` or ask.

### Prohibited Output Patterns

**NEVER write these to `.squad/` files:**

The rest: https://github.com/microsoft/waza/blob/HEAD/.github/skills/secret-handling/SKILL.md