## The passphrase

The `dev` stack uses Pulumi's passphrase secrets provider with an **empty passphrase**,
set in the bootstrap steps in `../README.md`.

That is fine only while **no secret is stored in stack config**. An empty passphrase plus
the `encryptionsalt` committed in `Pulumi.dev.yaml` means any `secure:` value in that file
is recoverable by anyone who can read this repo. The Cloudflare token therefore lives in
`CLOUDFLARE_API_TOKEN` in the environment instead — see `./CLOUDFLARE.md`.

**Before putting any secret in stack config, change the secrets provider.** Otherwise the
value is public to everyone with repo access the moment it is committed.

## Updating the passphrase

pulumi stack change-secrets-provider passphrase