Secure fields, secrets, and disclosure

Secure fields

A secure custom field stores encrypted content and cryptographic metadata. Plaintext is not left available to every downstream subsystem.

Consequences

• Secure values are excluded from ordinary search indexing.
• Secure values are excluded from AI retrieval by storage/processing design, not merely by prompt instructions.
• Reveal/decrypt is an explicit privileged action and can be audited, including denied attempts.

Secrets

Raw refresh tokens, invitation tokens, password-reset tokens, API client secrets, MFA recovery values, Stripe secrets, and integration credentials must not be persisted as ordinary plaintext. Prefer hashes for one-time authentication tokens and a secret vault/encrypted service boundary for credentials that must later be used.