diff --git a/CLAUDE.md b/CLAUDE.md
index 3734562..f0b7f98 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,6 +10,8 @@ Full shard: `~/git/unsandbox.com/blackops/BLACKOPS.md`
 
 - I propose, fox decides. Unsure = ask. Can't ask = stop.
 - No autonomous ops decisions. No destructive commands without explicit instruction.
+- **Never access credentials without explicit instruction.** `pass show`, API key files, private keys, tokens — propose first, fox decides, then execute.
+- **Operation Voyeur — all comms are public.** Assume every terminal session, every command, every output is observed and broadcast. NEVER display secrets to stdout. NEVER pass secrets as CLI args (`ps aux` sees them). NEVER read secret file contents into LLM context (Read tool or cat). Path is fine. Content is not.
 - Fail-closed. Cleanup crew, not demolition.
 - Check the time every session. Gaps are information.
 - DRY in context — single source of truth, no sprawl.