# Security notes

## Credentials

- `config.toml` is intentionally ignored via `.gitignore`.
- If `config.toml` (or any file containing credentials) was ever committed to git history, treat those credentials as compromised.

## Credential rotation checklist

1. Rotate the database password / token.
2. Invalidate any exposed API tokens.
3. Re-issue credentials with least-privilege read-only access.
4. Audit logs for suspicious access.

## Git history cleanup (if needed)

If a secret accidentally entered git history, remove it from history using secure tools (for example `git filter-repo`) and force-push.

Do **not** rely on a simple revert; secrets remain accessible in history.