# Security policy — mgf-secrets

## Supported versions

| Version | Supported |
|---|---|
| 0.1.x (pre-alpha) | ✅ current |

## The one rule (AG-18)

Secret **values never enter** this tool's context, output, transcripts, logs, or
committed files. The registry declares *where* credentials live and *how* they are
governed — never the values. `list`/`show` are metadata-only; `doctor` C6 decodes
a JWT `exp` in-process and emits only the integer. The redaction property test
(`tests/unit/test_redaction.py`) drives the whole CLI surface with planted canary
values and asserts their absence from every output stream.

## Reporting

This is a private Foundation repo. Report any suspected value leakage or a doctor
false-negative directly to the maintainers (founder + operator); do not open a
public issue.
