# Secret Policy

Status: VERIFIED BY LOCAL SELF-TEST

## Rule

Generated repos must not contain credentials, API keys, private keys, or service
tokens.

The secret gate scans text files for common credential shapes:

- private key blocks;
- AWS access key IDs;
- GitHub tokens;
- OpenAI-style tokens;
- Slack and Discord tokens;
- generic key/secret/token/password assignments.

Default scan size is 2 MiB per text file, matching the payload gate's per-file
limit so allowed text payloads are still inspected.

## Command

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\Test-H8SecretPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export
```