geointel/docs/30-codex-optimization/SECRETS_AND_ENV_POLICY.md

Secrets and Environment Policy

GeoIntel must be safe to publish as a portfolio repository.

Absolute rules

• Never commit real API keys.
• Never commit credentials, tokens, cookies or private endpoints.
• Never place secrets in docs, fixtures, tests or screenshots.
• .env.example may contain placeholder values only.
• Runtime secrets are read from environment variables.
• If a real key is accidentally found, remove it and rotate it outside the repo.

Approved environment variables

• DATABASE_URL
• POSTGRES_HOST
• POSTGRES_PORT
• POSTGRES_DB
• POSTGRES_USER
• POSTGRES_PASSWORD
• REDIS_URL
• STORAGE_ROOT
• OPENAI_API_KEY
• COPERNICUS_CLIENT_ID
• COPERNICUS_CLIENT_SECRET
• GRB_WFS_BASE_URL
• OSM_OVERPASS_URL

Codex behavior

When credentials are missing, Codex must:

1. implement a clear configuration error;
2. document the missing variable;
3. provide an example in .env.example;
4. avoid hardcoded fallback secrets;
5. keep external-service calls behind adapters.

Local development fallback

For V1 foundation work, services should be able to run with:

• local PostGIS;
• local Redis;
• fixture datasets;
• disabled external fetchers;
• deterministic demo outputs.

This fallback is not fake production behavior. It is a development mode and must be labeled as such.