# Secrets and Environment Policy

GeoIntel must be safe to publish as a portfolio repository.

## Absolute rules

- Never commit real API keys.
- Never commit credentials, tokens, cookies or private endpoints.
- Never place secrets in docs, fixtures, tests or screenshots.
- `.env.example` may contain placeholder values only.
- Runtime secrets are read from environment variables.
- If a real key is accidentally found, remove it and rotate it outside the repo.

## Approved environment variables

- `DATABASE_URL`
- `POSTGRES_HOST`
- `POSTGRES_PORT`
- `POSTGRES_DB`
- `POSTGRES_USER`
- `POSTGRES_PASSWORD`
- `REDIS_URL`
- `STORAGE_ROOT`
- `OPENAI_API_KEY`
- `COPERNICUS_CLIENT_ID`
- `COPERNICUS_CLIENT_SECRET`
- `GRB_WFS_BASE_URL`
- `OSM_OVERPASS_URL`

## Codex behavior

When credentials are missing, Codex must:

1. implement a clear configuration error;
2. document the missing variable;
3. provide an example in `.env.example`;
4. avoid hardcoded fallback secrets;
5. keep external-service calls behind adapters.

## Local development fallback

For V1 foundation work, services should be able to run with:

- local PostGIS;
- local Redis;
- fixture datasets;
- disabled external fetchers;
- deterministic demo outputs.

This fallback is not fake production behavior. It is a development mode and must be labeled as such.