Security No real credentials belong in source or docs. Runtime secrets must come from environment configuration outside versioned files.