Pattern 6

Credentials live in one place, never in files

Problem. A secret written to a file leaks: into git history, into a backup, into an agent's context window, into a screenshot.

Pattern. A password manager is the single store. Files reference the item name, never the value. Running code resolves the secret at runtime and scrubs it afterward. Allow one narrow, audited exception per genuine need (a self-only email sender, say), not a general waiver.

Why this beats the obvious. A .env file and "I'll just paste it for now" are how secrets end up in transcripts forever. One store with runtime resolution keeps the value out of every durable surface.

Cost. A runtime lookup step, and the discipline to refuse the convenient shortcut.

Where it lives: samples/scripts/backup-restic.ps1 (runtime resolution + scrub) and samples/scripts/send_self_email.py (the one narrow, audited exception).

Seen in 2 of 8 teardowns · Practise: learn/04