# Secret Policy

This project is public-data only.

Rules:

- Do not commit exchange private keys or tokens.
- Do not add order execution or private trading endpoints.
- Do not expose secret values in logs, docs, or API responses.
- Treat `CRYPTOCOMPARE_KEY`, `COINGECKO_API_KEY`, `CRYPTOPANIC_KEY`, and similar values as optional Space secrets only.
- Prefer keyless public providers first whenever possible.

When data is unavailable, the gateway should be honest:

- return degraded or unavailable state
- activate `noTradeGuard`
- explain the missing capability or provider failure