> ## Documentation Index
> Fetch the complete documentation index at: https://tashfiq.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AE-SEC-001

> No raw secret patterns in agent-visible context files — AGENTS.md, CLAUDE.md, .cursor/rules, .windsurfrules, .github/copilot-instructions.md, opencode.md, codex.md, DESIGN.md, SKILL.md.

**Rule ID:** AE-SEC-001 · **Severity:** <Badge color="red">Blocker</Badge> · **Category:** Secrets · **Auto-fixable:** No

<Warning>
  Charter never auto-fixes secret findings. Removing the literal value from the file is not a complete fix — the credential must be rotated externally first. Assume it was exposed the moment it was committed.
</Warning>

## Why this rule

Agent context files are read on every task. A raw credential in `AGENTS.md` is visible to every model session, every log that captures context windows, and every tool invocation that passes the context forward. Rotation after exposure is the only safe recovery — the secret cannot be "un-seen."

## What triggers it

Charter scans git-tracked agent-visible files for high-confidence credential patterns:

| Pattern                      | Example prefix                    | Min length    |
| ---------------------------- | --------------------------------- | ------------- |
| OpenAI API token             | `sk-`                             | 20 characters |
| GitHub personal access token | `ghp_`                            | 30 characters |
| AWS access key ID            | `AKIA`                            | 16 characters |
| Slack bot token              | `xoxb-`                           | 20 characters |
| PEM private key              | `-----BEGIN ... PRIVATE KEY-----` | —             |

**Scanned files:** `AGENTS.md`, `CLAUDE.md`, `.cursor/rules`, `.windsurfrules`, `.github/copilot-instructions.md`, `opencode.md`, `codex.md`, `DESIGN.md`, `SKILL.md`.

Only literal credential values trigger the finding. Detected values are redacted in Charter output (first 4 characters followed by `…`).

## Examples

<Tabs>
  <Tab title="Failing">
    ```markdown AGENTS.md theme={null}
    # Setup

    OPENAI_API_KEY=sk-proj-REPLACE_WITH_REAL_VALUE
    ```

    ```
    # Charter detects: sk-p… (redacted) in AGENTS.md — fires Blocker
    ```
  </Tab>

  <Tab title="Passing">
    ```markdown AGENTS.md theme={null}
    # Setup

    OPENAI_API_KEY=${OPENAI_API_KEY}
    ```

    ```markdown AGENTS.md (placeholder also passes) theme={null}
    # Setup

    OPENAI_API_KEY=your-api-key-here
    ```
  </Tab>
</Tabs>

## How to fix

<Steps>
  <Step title="Rotate the credential externally">
    Revoke and regenerate the secret in the provider's dashboard. The commit that introduced the literal value exposed it — assume it is compromised regardless of repo visibility.
  </Step>

  <Step title="Remove the literal value from the file">
    Delete the raw credential from the context file. Do not just move it to a comment or mask part of it.
  </Step>

  <Step title="Replace with an environment variable reference">
    Use `${OPENAI_API_KEY}` or `$OPENAI_API_KEY` in place of the literal value. Most agent runtimes and CI systems resolve env refs at execution time.
  </Step>

  <Step title="Commit the fix">
    Commit the updated file. Charter will re-scan on next run and clear the finding once no literal credential is detected.
  </Step>

  <Step title="If the secret is already in git history">
    The secret is compromised. Rotate first (step 1), then consider a history rewrite (`git filter-repo`) — but note that history rewriting is destructive and requires coordination with all collaborators.
  </Step>
</Steps>

## Score impact

<Warning>
  `Blocker` (−20 per finding) with a raw-secret cap: the final [score](/docs/concepts/scoring-and-caps) is held at **≤49** while AE-SEC-001 or AE-SEC-002 is active. This overrides the base formula — the repo cannot reach 50 or above until the finding is resolved. Caps are reserved for raw-secret and Blocker findings.
</Warning>

## Edge cases

* **Neutralized values never fire.** Environment variable references (`${VAR}`, `$VAR`) and the placeholder string `your-api-key-here` are explicitly excluded — only literal credential values trigger the finding.
* **Only git-tracked files are in scope.** Uncommitted local files are never scanned.

## Related rules

<CardGroup cols={2}>
  <Card title="AE-SEC-002" icon="lock" href="/rules/AE-SEC-002">
    Same patterns applied to MCP config files.
  </Card>

  <Card title="AE-CTX-001" icon="file-text" href="/rules/AE-CTX-001">
    Context file must exist and be within budget.
  </Card>
</CardGroup>

## CLI

```bash theme={null}
charter explain AE-SEC-001
```