ADR-002 Never store user secrets
| Status | Accepted |
| Date | 2026-09-20 |
Context
People will try to store the thing they are most afraid of losing: banking passwords, email passwords, PINs, seed phrases. Doing so would make Titip a high-value credential store and would contradict the product promise. A breach would be catastrophic in a way a guidance leak is not.
Decision
Titip must not persist passwords, PINs, one-time passcodes, CVVs, recovery phrases, seed phrases, private keys, or any other value whose purpose is to authenticate to another system.
The canonical prohibition list is policies/security.md. Schemas must not include fields for those values. The instruction write path must reject payloads that contain those field names and should reject obvious secret patterns in free text.
Allowed content is guidance: institution name, account type, who to contact, where the original document is stored.
This decision is permanent. It is not a prototype limitation.
Consequences
- Users who want a password manager are sent elsewhere, in product copy, not given a “secure notes” exception.
- Digital-asset guidance may name an exchange or a device. It may not contain a seed.
- AI assistants use the same prohibition (TITIP-012).
- Detection of secrets in prose will miss some cases. That does not weaken the rule. It means review and owner education stay necessary.