bootstrap/templates/agent/fragments/secrets.md

Secrets Management

NEVER hardcode secrets. Use .env files (gitignored) or a secrets manager.

# .env.example is committed (with placeholders)
# .env is NOT committed (contains real values)

Ensure .gitignore includes .env* (except .env.example).