# Vault (encrypted-only)

This directory contains **encrypted artifacts only**.

Rules:

- Never commit plaintext secrets (even temporarily).
- Never commit private keys.
- Treat `vault/` as safe-to-leak ciphertext: if leaking it would break you, it is mis-scoped.

Decryption/working material belongs in `vault/tmp/` (gitignored) and should be wiped after use.