From 6a758b010f6facba18a49aec03a03c21d36cd4dc Mon Sep 17 00:00:00 2001
From: OE6DXD <oe6dxd@arcg.at>
Date: Tue, 17 Mar 2026 23:55:33 +0100
Subject: [PATCH] document public-repo security boundary in working context

---
 WORKING_CONTEXT.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/WORKING_CONTEXT.md b/WORKING_CONTEXT.md
index 24e2d98..711c0b5 100644
--- a/WORKING_CONTEXT.md
+++ b/WORKING_CONTEXT.md
@@ -22,6 +22,12 @@ Not included here:
 - station hostnames and private endpoints
 - station-specific bandmaps/bandplans/deploy service wiring
 
+## Security Boundary (Public Repo)
+
+- This repository is public.
+- Never commit live configurations, production environment files, credentials, tokens, private hostnames, or any sensitive operational data.
+- Keep all live/runtime secrets in deployment/runtime environment layers outside this repository.
+
 ## Configuration Layers
 
 Expected priority order: