diff --git a/HANDOFF.md b/HANDOFF.md
index 00a60a4..2979185 100644
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -134,3 +134,9 @@ track (YouTube mutes VODs with copyrighted music — future feature), itch.io `P
 - The original outage was an interrupted Mastodon upgrade + a DO `password_reset` reboot; everything
   came back on its own after boot. No code/schema damage observed.
 
+**Secrets (removed 2026-08-14 — see git history if a value is ever needed again):** the DO API token,
+the gramps/root passwords and the DO password-reset email password were recorded in this file and in
+chat. They are treated as **compromised** — the DO API token and every listed password have been or
+should be rotated/revoked, and **no new secrets belong in this repo or in chat**. Secret paths that
+stay here are the file locations only (OAuth creds → `Helpers/OAuthCredentials.cs`, session token →
+`Helpers/TokenStore.cs`).