Secrets & credentials management

When to use this skill

Use this skill whenever code handles sensitive credentials:

• Storing an API key, webhook secret, or service token from a settings form.
• Building a custom login or token-verification flow.
• Generating reset tokens, API keys, or one-time nonces that must stay secret.
• Logging or exporting data that might accidentally include secrets.
• Deciding whether to use the user's account password or an application-specific password for API/integration access.

Secrets in source code, reversible password storage, and plaintext API keys in options are common sources of credential leaks.

Related: see the nonces-csrf-protection skill for CSRF tokens and the settings-options-security skill for sanitizing option values.