docs/security/SECRET_POLICY.md

Secret Policy

This project is public-data only.

Rules:

• Do not commit exchange private keys or tokens.
• Do not add order execution or private trading endpoints.
• Do not expose secret values in logs, docs, or API responses.
• Treat CRYPTOCOMPARE_KEY, COINGECKO_API_KEY, CRYPTOPANIC_KEY, and similar values as optional Space secrets only.
• Prefer keyless public providers first whenever possible.

When data is unavailable, the gateway should be honest:

• return degraded or unavailable state
• activate noTradeGuard
• explain the missing capability or provider failure