• Never commit .env or real API keys.
• Never print secrets in logs or agent output.
• Secrets come from environment variables or a secret manager only.
• Use .env.example with placeholder values.
• External updates (Linear, Slack, GitHub) must be sanitized.
• Test fixtures must not contain real credentials.
• Do not hardcode tracking IDs in source code.

• LLM API keys (OpenAI, Anthropic, DeepSeek)
• Design scout / SERP research API keys
• Any future database with campaign or lead data

Run security audit as part of full harness:

python scripts/audit/security_audit.py

Checks for committed .env, common secret patterns, and unsafe defaults.