Decision: maps.lab stays public (Obsidian embeds); never publish secrets there

AGENTS.md

@@ -171,8 +171,25 @@ Resolved:
 2. Scanning is accepted as normal — the goal is **control**, not zero noise.
 3. Authelia over Authentik (lighter, fits Caddy forward-auth).
 
+**`maps.lab` — PUBLIC BY DESIGN (decided 2026-10-14).**
+
+Obsidian embeds the Archify maps and Gitea content, so `maps.lab` must stay
+reachable without auth. Accepted: it discloses internal hostnames, ports and
+service names to anyone who asks.
+
+Rationale from Sam: *"the network info is not really that bad — if someone gets
+in they have that anyway. No keys, passwords etc matter."*
+
+Rules that follow from this:
+- **NEVER publish a secret, key, password, token or credential to `maps.lab`.**
+  It is world-readable. (Publishing a *public* SSH key is fine.)
+- Directories named after secrets (for example `inmotionhosting_S3_email`) must
+  not contain sensitive material.
+- Optional hardening, not required: turn off directory `browse` so the tree index
+  is not listable while direct links keep working.
+
 Remaining:
-1. Which hosts are **genuinely public**? (Needs Sam's list for the allowlist.)
+1. Which other hosts are **genuinely public**? (Needs Sam's list for the allowlist.)
 2. Should CrowdSec run in **ban** mode from the start, or observe first?
 3. Where do the alerts go — Apprise to which channel?
 4. Do we add `nuclei`/`semgrep` to Gitea CI, or run them by hand?