| # Secret Policy | |
| This project is public-data only. | |
| Rules: | |
| - Do not commit exchange private keys or tokens. | |
| - Do not add order execution or private trading endpoints. | |
| - Do not expose secret values in logs, docs, or API responses. | |
| - Treat `CRYPTOCOMPARE_KEY`, `COINGECKO_API_KEY`, `CRYPTOPANIC_KEY`, and similar values as optional Space secrets only. | |
| - Prefer keyless public providers first whenever possible. | |
| When data is unavailable, the gateway should be honest: | |
| - return degraded or unavailable state | |
| - activate `noTradeGuard` | |
| - explain the missing capability or provider failure | |