Public-safe content policy

This policy defines what is allowed in public docs.

Never publish

• Private keys, seed phrases, keystore data

• JWT/API secrets or encryption keys

• Database credentials

• Internal-only hostnames/IPs

• Local absolute machine paths

• Unredacted production incident data with sensitive metadata

Always sanitize

• Replace secrets with <REDACTED>

• Replace absolute local paths with <repo-root>/...

• Replace internal endpoints with <internal-endpoint>

Security review

Every docs PR must pass redaction review before merge.