From 06d70b9e925e690b2c3029c1a259c8a0c9a71a32 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sat, 28 Mar 2026 15:44:13 -0400 Subject: [PATCH] docs: never access credentials without explicit instruction --- CLAUDE.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 5783e3e..416bbe2 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -226,6 +226,10 @@ python scripts/spam/scan.py --json --threshold=0.8 | python scripts/spam/disable python scripts/spam/disable_spam.py node-uuid-1 node-uuid-2 ``` +## Credential Access + +**Never access credentials without explicit instruction from fox.** This includes `pass show`, reading API key files, private keys, session cookies, tokens, or any secrets. Propose first. Fox decides. Then execute. + ## Production Rules **NEVER run direct SQL or raw database commands on production.** No `sqlite3`, no `UPDATE`, no `DELETE`, no direct file edits on the production database. Ever. If the API doesn't support what you need, add the endpoint first, push it, then use the client.