diff --git a/WORKING_CONTEXT.md b/WORKING_CONTEXT.md
index 24e2d98..711c0b5 100644
--- a/WORKING_CONTEXT.md
+++ b/WORKING_CONTEXT.md
@@ -22,6 +22,12 @@ Not included here:
 - station hostnames and private endpoints
 - station-specific bandmaps/bandplans/deploy service wiring
 
+## Security Boundary (Public Repo)
+
+- This repository is public.
+- Never commit live configurations, production environment files, credentials, tokens, private hostnames, or any sensitive operational data.
+- Keep all live/runtime secrets in deployment/runtime environment layers outside this repository.
+
 ## Configuration Layers
 
 Expected priority order: