.claude docs/ # secret guardrails — keep credentials out of the repo secrets/ *.age *.key *.pem .env .env.*