Rules
- Hosted deployment credentials live in environment-scoped GitHub Actions secrets.
- Runtime and build-time configuration for hosted apps lives in the hosting provider’s project environment, not in workflow-wide variables.
- Local development reads
apps/web/.env.local(copy the checked-in example and fill in your own values). - Never commit tokens, keys, passwords or rendered environment dumps, and do not edit checked-in compose files to inject per-environment secrets.
- Rotate a credential independently of unrelated ones, and revoke it when its purpose ends.
- Each app’s documentation lists the configuration names it reads and whether each is required, optional or server-only.