secret-handling

How to work with credentials at Flux Point — never reading a secret, passing its path to code that emits only public derivations, keeping a passphrase off the command line, filtering config dumps at the source, and the repr hazard that leaks a signing key through an f-string or a traceback. Use whenever the work touches a mnemonic, a wallet file, a signing key, a passphrase, a signed transaction or witness, a .env or an API token, whenever a permission rule denies a read the work actually needs, whenever an operator is about to hand-edit settings.json to unblock a session, or whenever custody of a key must be proved, restored or rotated, even if nobody says "secret handling".