If you have any AI API key: check where it's stored, when it last rotated, and what it can access. No key? Write the 3 rules where your team will see them. You're done when one concrete improvement happened — a rotation, a scope cut, or the posted rules.
How-to · BLD · BLD.1
API key hygiene — the three rules
Keys never go in shared prompts or client code, get rotated when exposed, and get scoped to least privilege.
Worked example
An API key is a password that spends money. Three rules cover most disasters: never paste keys into prompts, chats, or client-side code; rotate immediately if exposed; scope each key to the least access that works. Everything else is commentary.