diff --git a/.claude/commands/wiki-compile.md b/.claude/commands/wiki-compile.md
index 81a2e88..3839581 100644
--- a/.claude/commands/wiki-compile.md
+++ b/.claude/commands/wiki-compile.md
@@ -333,6 +333,7 @@ RULES:
 4. Active Work: use Syncro open ticket list as the primary source
 5. History Highlights: chronological, from session logs only, one-line entries with dates
 6. Access: vault paths and IPs from session logs; never invent vault paths
+6b. NEVER inline raw secrets (passwords, PSKs, RADIUS/shared secrets, API keys, PFX passwords) into the article, even when a session log exposes them. The wiki references the vault path only — e.g. `sysadmin (password: vault)` or `secret in vault (clients/<slug>/server.sops.yaml)`. Raw secrets live in session logs and the SOPS vault, never in the wiki knowledge layer. (Exception: a value the EXISTING article already discloses may be carried over to match its disclosure level — do not ADD new ones.)
 7. For fields with no source data: write "(verify)" not placeholder text
 8. Backlinks: list any wiki article slugs (clients/projects/systems) that this client is cross-referenced with
 ```