Initial public release

docs/30-codex-optimization/SECRETS_AND_ENV_POLICY.md

@@ -0,0 +1,50 @@
+# Secrets and Environment Policy
+
+GeoIntel must be safe to publish as a portfolio repository.
+
+## Absolute rules
+
+- Never commit real API keys.
+- Never commit credentials, tokens, cookies or private endpoints.
+- Never place secrets in docs, fixtures, tests or screenshots.
+- `.env.example` may contain placeholder values only.
+- Runtime secrets are read from environment variables.
+- If a real key is accidentally found, remove it and rotate it outside the repo.
+
+## Approved environment variables
+
+- `DATABASE_URL`
+- `POSTGRES_HOST`
+- `POSTGRES_PORT`
+- `POSTGRES_DB`
+- `POSTGRES_USER`
+- `POSTGRES_PASSWORD`
+- `REDIS_URL`
+- `STORAGE_ROOT`
+- `OPENAI_API_KEY`
+- `COPERNICUS_CLIENT_ID`
+- `COPERNICUS_CLIENT_SECRET`
+- `GRB_WFS_BASE_URL`
+- `OSM_OVERPASS_URL`
+
+## Codex behavior
+
+When credentials are missing, Codex must:
+
+1. implement a clear configuration error;
+2. document the missing variable;
+3. provide an example in `.env.example`;
+4. avoid hardcoded fallback secrets;
+5. keep external-service calls behind adapters.
+
+## Local development fallback
+
+For V1 foundation work, services should be able to run with:
+
+- local PostGIS;
+- local Redis;
+- fixture datasets;
+- disabled external fetchers;
+- deterministic demo outputs.
+
+This fallback is not fake production behavior. It is a development mode and must be labeled as such.