# What counts as a secret?

_{This page means}

A secret here	Not a secret in this sense
_{Anything that lets a third party bill you, read mail, write repos, or act as your bot}	_{Public URLs, doc links, or your own marketing copy}
_{API keys, tokens, PATs, integration secrets, webhook signing secrets}	_{The fact that you use Stripe or Notion (that is not private)}

_{The list (memorize the shape, not every prefix)}

{% stepper %} {% step %} _{**Integration secrets**} _In _**Settings** _{for Serper, Firecrawl, GitHub, Vercel, Neon, Stripe, Telegram, Resend, Notion, Claude, E2B, and similar.} {% endstep %} {% step %} _{**Session & identity**} _{Material tied to} _*your* _{sign-in (password manager entries, recovery codes). Those live with your identity provider habits, not inside ARIA tables.} {% endstep %} {% step %} _**Labels** _{**Anything labeled “secret,” “private,” “internal integration,” or “signing”**} _{in a vendor console.} {% endstep %} {% endstepper %}

_{Three Habits}

{% stepper %} {% step %} _**First** _{If you are unsure, treat it as a secret. Downgrading later is easier than unwinding a paste into a shared doc.} {% endstep %} {% step %} _**Second** _Prefer _**Test** _{in the product over “I will curl it from my laptop” when you want proof. Tests are designed to exercise the same server path the app uses.} {% endstep %} {% step %} _**Third** _**`Remove`** _{button in ARIA deletes the stored value from this workspace’s integration store. It does} _**not** _{revoke the key at the vendor. Rotation happens in the vendor console first.} {% endstep %} {% endstepper %} ***

_{Ask a question}

_{Where did you paste a key “just to try”?}
_{If the answer is a chat tool, rotate at the vendor and re-save in Settings after.}

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.ariaagi.com/security-and-privacy/what-counts-as-a-secret.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.