hyb-oa/.trellis/spec/hyb-oa/security-privacy.md

Security And Privacy

Never Store In Repo / Trellis / Chat

• Passwords, token, Secret, private keys, EncodingAESKey.
• Full personal accounts, full phone numbers, full email addresses where not required for local config.
• Raw invoice images, contract bodies, bank statement originals, payment credentials, sensitive quotes, cost details.
• Complete local paths to confidential company directories.
• Enterprise WeChat raw payloads, full sp_no, full template IDs, full userid, form values, attachments or comments.

Trellis-Specific Rules

• .trellis/workspace/ is local-only by default.
• .trellis/tasks/ may contain PRD and acceptance context, but only in redacted form.
• scripts/qa/check-trellis-governance.mjs must pass before commit.