filemaker-ai-core/docs/security-and-redaction.md

Security and Redaction

Private Git hosting does not make secrets safe to commit. FileMaker DDR can expose credentials through custom functions, calculations, scripts, data sources, and integration settings.

Before a parsed DDR is committed or shared:

1. Scan for private keys, tokens, passwords, client secrets, API keys, and connection strings.
2. Redact values deterministically while retaining the object name and enough structure for analysis.
3. Review the resulting diff.
4. Rotate any active credential that may have entered Git history.
5. Keep raw DDR and original secret-bearing exports outside Git.

Never add a real secret to this core repository, examples included.