Part 10

Secrets, sessions and trust: not every value belongs in a script

Automation becomes dangerous when every useful value is treated as harmless text. Passwords, private keys, cookies and authentication state need a different lifecycle from paths, image sizes or database table names.

Classify the value before you automate it

A path, archive name or image width is ordinary configuration. A password, private key, session token or database credential can grant access. Putting both kinds of values into the same reusable script makes the script itself a secret.

Before saving a value, ask two questions: could this value authorize something, and would I be comfortable copying this file to another project or sharing it for review? If not, keep the secret out of the recipe.

Environment inspection is useful, but the environment is not a vault

env intentionally masks sensitive-looking values. That is a presentation safety feature, not proof that every environment variable is safe or that no secret exists under an unexpected name.

Inspect only the namespace or value you need. Avoid screenshots and exports of full environment dumps, and never turn a masked terminal view into permission to publish the underlying server configuration.

env

env server

env request

Sessions and cookies are application state, not scratch text

ses shows hierarchical PHP session data and coo shows visible cookies as a deliberately separate surface. Protected authentication/session-cookie state is blocked from ordinary export and overwrite paths.

That boundary matters because session data can carry identity, authorization and temporary application state. Inspect narrowly, modify only namespaces you own, and do not use session storage as a convenient place to hide long-lived secrets.

ses -l

coo

coo -a

A hash can prove sameness; it cannot hide the original

hash calculates digests and HMACs. A digest is excellent for answering “did these bytes change?” and for recording the identity of an archive or release artifact.

Hashing is not encryption. If the original value comes from a small guessable set, a hash does not make it confidential. Use HMAC when authenticity depends on a secret key, and encryption when the content itself must remain unreadable.

hash -s "hello terminal"

hash

Encryption protects content only while the key is protected too

enc uses authenticated ciphers, hidden password prompts and exact-key modes. Start with enc to see what the server supports; encrypting through the default password prompt keeps the password out of visible command history.

An encrypted file beside its exposed key is not protected. Keep keys and encrypted data on different trust boundaries where possible, understand how recovery will work, and test decryption before deleting the plaintext source.

enc

Filesystem permissions reduce access; they do not replace cryptography

A mode such as 0600 says that the current filesystem owner should be the only ordinary reader/writer. It is useful for local key files and private exports when the hosting filesystem honors UNIX modes.

Permissions do not protect data from the hosting account owner, backups or a compromised PHP process. Use stat after mod to verify what actually changed, and combine permissions with the right storage and encryption model.

cd lil-playground

md trust

echo "example private note" > trust/note.txt -r

mod trust/note.txt -0600

stat trust/note.txt

hash trust/note.txt

Know the difference between cleanup, uninstall and destruction

clear only clears the visible transcript. uninstall <module> removes an extension module. kill -include removes the optional interface layer, kill -install removes the extension layer, and bare kill is the full terminal-destruction boundary.

These actions should never blur together in muscle memory. Before any destructive operation, name the layer you intend to remove and the files you expect to remain. A safe terminal user can explain the rollback before pressing Enter.

Visual cleanupclearTranscript only; files and modules remain

Module removaluninstall <module>One extension module; dependency rules apply

Interface resetkill -includePersistent/session CSS and JavaScript layer

Extension resetkill -installInstalled extension layer; Core remains

Full removalkillThe lil-terminal installation itself

Keep this as a script

Save this as trust-checkpoint.lil. It creates only example data, applies a restrictive file mode, records metadata and stores a digest. Notice what it deliberately does not automate: password entry and decryption keys stay outside the script.

#lil
@install md echo mod stat hash
cd lil-playground
md trust
echo "example private note" > trust/note.txt -r
mod trust/note.txt -0600
stat trust/note.txt
hash trust/note.txt > trust/note.sha256 -r
stat trust/note.sha256