From 5d03fd98bec39280298a386f94cbaa8e5fc60b7d Mon Sep 17 00:00:00 2001
From: null <koga.industries@gmail.com>
Date: Tue, 7 Jul 2026 22:32:37 -0500
Subject: [PATCH] chore(qa): keep fixture credentials in a gitignored local
 file, not the repo

Test-account emails/uids/passwords now live in qa/fixtures.local.md (gitignored);
qa/README.md carries only a pointer. Credentials must never be committed or pushed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitignore   | 4 ++++
 qa/README.md | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/.gitignore b/.gitignore
index 46993701..dbcb44a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -91,3 +91,7 @@ docs/strategy/positioning-vs-paired.md
 ClaudeQAPlan.md
 ClaudeReport.md
 relationship-app.code-workspace
+
+# QA fixtures with test credentials — local only, never commit
+qa/fixtures.local.md
+qa/*.local.md
diff --git a/qa/README.md b/qa/README.md
index cd6b3b75..c4e0c87b 100644
--- a/qa/README.md
+++ b/qa/README.md
@@ -33,3 +33,8 @@ NODE_PATH=functions/node_modules node qa/qa_push.js <uid> chat_message conversat
 - coupleId `Xal3Kw3gjSdn0niERYKJ`
 - QA (emulator-5554) `Y05AKO2IlTPMa0JQW1BiNIM0uzK2` · Sam (emulator-5556) `imDjjOTTQvXGGjyUhUc5JSeHWkU2`
 - Admin SA JSON: `~/.config/closer/closer-admin-sa.json` (kept OUTSIDE the repo; override path via `SA_JSON`). For tools using Application Default Credentials: `export GOOGLE_APPLICATION_CREDENTIALS=~/.config/closer/closer-admin-sa.json`.
+
+## Fixture accounts & passwords
+Live test-account emails, uids, AVD mapping, and passwords are kept OUT of this repo in the
+gitignored `qa/fixtures.local.md` (dev-project throwaway creds). Ask the operator or read that
+local file. Never commit credentials.