Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

docs/02-security/SECRETS_AND_REDACTION.md

@@ -0,0 +1,45 @@
+# Secrets and Redaction
+
+## Storage
+
+Secrets are supplied through Docker secrets or read-only files below `/run/secrets`. Configuration stores only a secret reference.
+
+Example:
+
+```yaml
+credentials:
+  type: docker_secret
+  reference: gitea_mcp_read_token
+```
+
+No real secret appears in Git, catalog YAML, `.env.example`, test fixtures, screenshots, evidence, or generated client configuration.
+
+## Redaction stages
+
+1. reject secret-shaped input where a field should not accept it;
+2. omit sensitive headers from logs;
+3. sanitize target-system output in the connector;
+4. apply a final result redaction profile;
+5. sanitize audit arguments and response summaries;
+6. run automated secret scanning over repository and evidence.
+
+## Patterns
+
+At minimum detect:
+
+- bearer/JWT tokens;
+- basic auth values;
+- private-key blocks;
+- common API key formats;
+- connection strings with passwords;
+- cookies and session IDs;
+- Authentik/Gitea tokens;
+- environment variable names marked sensitive.
+
+## Audit representation
+
+Use a stable argument hash and a small sanitized projection. Never solve auditability by storing the entire raw request.
+
+## UI
+
+Secret fields are write-only. The UI shows state such as `configured`, `missing`, or `last rotated`, never the value or a reversible masked form.