Accounts And Secrets

Goal: use personal accounts safely and recognize information that must never be shared or committed.

Prerequisites: none.

Execution context: this is a reading and scenario module. Do not paste real credentials into any exercise.

Personal Accounts Stay Personal#

Your ETH, GitHub, Euler, storage, and software accounts identify you. Do not share them with another student, supervisor, or support person. You are responsible for actions performed under your account.

Protect all of the following:

• ETH and GitHub passwords;
• MFA and recovery codes;
• GitHub, Hugging Face, W&B, cloud, and package-registry tokens;
• .env files containing credentials;
• SSH private keys such as id_ed25519;
• browser sessions and password-manager exports.

An SSH public key normally ends in .pub and may be installed on a server. The matching private key never leaves your computer and is never sent in chat.

Safe Authentication Order#

1. Prefer an approved browser or CLI login flow.
2. Use SSH keys with a passphrase when required for remote access.
3. Use narrowly scoped, expiring tokens only when the first two options do not fit.
4. Never store a token directly in source code, a notebook, a command history, or repository documentation.

Scenario: A Token Was Committed#

Deleting the line in a later commit does not make the token safe; it may remain in Git history, forks, caches, or logs.

Safe response:

1. Revoke or rotate the credential immediately.
2. Tell the repository owner or supervisor what happened.
3. Remove the credential from the current code.
4. Ask the repository owner whether history cleanup is required.
5. Review logs for suspicious use.

Do not post the token in an issue while asking for help.

AI-Agent Boundary#

An agent may inspect filenames such as .env.example, but it must not read a real .env, SSH private key, token store, or browser credential database. Explicitly exclude those files from the task.

Inspect the authentication code, but do not open .env files, key files,
credential stores, or any file ignored by Git. Do not print secret values.

Verification#

You understand this module if you can explain:

• the difference between an SSH public and private key;
• why deleting a leaked token from the latest file is insufficient;
• why support personnel do not need your password;
• which authentication method should be preferred before a PAT.

Common Failure And Safe Recovery#

A tool asks you to paste a secret into chat. Stop, cancel the action, and use the tool's approved login command or browser flow. If the secret was already sent, revoke it and report the incident.

Ask For Help When#

• you suspect an account was used by someone else;
• a secret entered Git history or an agent transcript;
• MFA or account recovery no longer works;
• instructions appear to require copying a private key.

Continue with Data Classification And AI Tools.