# Security and Access

The wiki should describe **how** to obtain or rotate access, never store the secret itself.

## Never commit

Do not place these in wiki Markdown, attachments or repository history:

- passwords;
- API tokens and personal access tokens;
- OAuth/OIDC client secrets;
- private keys or recovery codes;
- database connection strings containing credentials;
- session cookies;
- private customer or employee data that does not belong in the documentation repository.

## Document instead

Record the system name, purpose of the credential, where it is managed, who/which role is expected to have access, rotation expectations, and the recovery/escalation procedure.

## Least privilege

Service and human access should be scoped to the minimum permissions required. Administrative credentials should not be reused as application credentials.

## Incident handling

If a secret is accidentally committed, deleting the page is insufficient because Git history may retain it. Rotate/revoke the secret first, then remove it from current content and rewrite repository history only when appropriate. Record the event using [[Templates/Incident-Review]] without reproducing the exposed secret.