Security Considerations

Never commit these to Git:

• API keys, tokens, passwords
• .env files with secrets
• mcp.json with resolved credentials
• Session history (may contain sensitive code)

Always commit these:

• Template files with $\{VAR_NAME\} placeholders
• .gitignore to prevent secret leaks
• Public agents/hooks/skills (if safe to share)

Best practices:

1. Use settings.template.json with placeholders → Generate settings.json via script
2. Run pre-commit hook to detect secrets
3. For MCP secrets, see Section 8.3.1 MCP Secrets Management