Execution safety, control 5 of 9
S-05 Keep secrets and confidential evidence out of outputs
P0Hard gateNeeds your evidence
Use secret references rather than raw credentials in plans and artifacts. Do not publish customer or operational data merely because it was available during an audit.
- Priority
- Gate. A FAIL stops publish or launch.
- Hard gate
- Yes. A FAIL stops publication, whatever the score.
- Change class
- READ_ONLY: Inspect authorised evidence.
- Quality bucket
- Not scored: hard gate only
Evidence to review
- Secret-handling design, output scan and permission/retention checks.
How to implement
- Minimise tool inputs and redact logs.
- Keep tenant data isolated and restrict evidence storage.
- Scan artifacts for secrets and personal identifiers before sharing.
- Use approved retention and deletion policies for raw evidence.
How UltimateSEO checks this
Needs your evidence. No automated check covers this control, so it stays UNKNOWN until evidence is supplied.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Part of The UltimateSEO Framework v4.3, catalogue dated 2026-10-14. Evidence states, control states and the publish gate are explained on the hub.