Security and Secrets

Generated from: https://github.com/mfittko/dev-loops
Source commit: c166d47
Compiled at: 2026-07-08T16:03:44.330Z
Page kind: security
Page state: generated
Confidence: medium
Claim status: grounded
Primary sources: .claude/hooks/_bash-command-classify.mjs, .claude/hooks/pre-tool-use-bash-gate.mjs, .claude/hooks/pre-tool-use-write-guard.mjs, .claude/skills/docs/artifact-authority-contract.md, .github/workflows/ci.yml, .github/workflows/release.yml, .github/workflows/wiki.yml, cli/index.mjs, Dockerfile, packages/core/src/loop/bash-command-classify.mjs, ... and 29 more

Security and Secrets

Security-sensitive source areas

• .claude/hooks/_bash-command-classify.mjs - configuration, source
• .claude/hooks/pre-tool-use-bash-gate.mjs - configuration, source
• .claude/hooks/pre-tool-use-write-guard.mjs - configuration, source
• .claude/skills/docs/artifact-authority-contract.md - auth, docs
• .github/workflows/ci.yml - ci, configuration
• .github/workflows/release.yml - ci, configuration
• .github/workflows/wiki.yml - ci, configuration
• cli/index.mjs - configuration, source
• Dockerfile - configuration, source
• packages/core/src/loop/bash-command-classify.mjs - configuration, source
• packages/core/test/debt-remediation-to-issue.test.mjs - configuration, test
• playwright.config.mjs - configuration, source
• scripts/repo-wiki.mjs - configuration, source
• skills/dev-loop/scripts/post-gate-verdict-fallback.test.mjs - configuration, test
• skills/docs/artifact-authority-contract.md - auth, docs
• test/_helpers.mjs - configuration, source
• test/dev-loops-cli.test.mjs - configuration, test
• test/extension-command-contract.test.mjs - api-surface, configuration, test
• test/extension-post-merge-update.test.mjs - api-surface, configuration, test
• test/github/probe-ci-status-lease-heartbeat.test.mjs - configuration, test
• test/github/probe-ci-status.test.mjs - configuration, test
• test/github/reply-resolve-review-thread.test.mjs - configuration, test
• test/github/request-copilot-review.test.mjs - configuration, test
• test/github/upsert-checkpoint-verdict.test.mjs - configuration, test
• test/github/wait-pr-checks.test.mjs - configuration, test
• test/loop/cli-primitives.test.mjs - api-surface, configuration, test
• test/loop/conductor-routing.test.mjs - configuration, test
• test/loop/copilot-pr-handoff.test.mjs - configuration, test
• test/loop/detect-copilot-loop-state-auto-detect.test.mjs - configuration, test
• test/loop/detect-pr-gate-coordination-state.test.mjs - configuration, test
• test/loop/detect-pr-gate-coordination-umbrella.test.mjs - configuration, test
• test/loop/info.test.mjs - configuration, test
• test/loop/inspect-run-cli.test.mjs - configuration, test
• test/loop/outer-loop-state-machine.test.mjs - configuration, test
• test/loop/outer-loop-test-helpers.mjs - configuration, source
• test/loop/pre-commit-branch-guard.test.mjs - configuration, test
• test/loop/pre-write-remote-freshness-guard.test.mjs - configuration, test
• test/loop/resolve-dev-loop-startup.test.mjs - configuration, test
• test/loop/run-watch-cycle.test.mjs - configuration, test

Policy

• Do not copy secrets or private tokens into wiki pages.
• Cite source paths instead of embedding sensitive source content.
• Require human review before publishing changes to authentication, authorization, billing, or deployment documentation.