RULES.md: state every action that asks for the password (closes #756 )

Replace the Secrets & Storage line "Password only required for signing operations" with the wording sneak approved: the password is required for signing, deleting a wallet, and showing a recovery phrase or private key. Model: opus-5-5
2026-11-13 18:43:49 +00:00
1 changed files with 3 additions and 3 deletions
@@ -75,8 +75,7 @@ contradicts either, the originals govern.
 ## DEBUG Mode
- [ ] DEBUG mode only enables: red banner naming the current screen, debug-level
+- [ ] DEBUG mode only enables: red banner + hardcoded test mnemonic
      logging, and the hardcoded test recovery phrase
 - [ ] No `if (DEBUG)` branches that skip functionality or bypass security
 - [ ] New DEBUG conditionals require explicit project owner approval
@@ -100,7 +99,8 @@ contradicts either, the originals govern.
 - [ ] Public data (xpubs, addresses, balances) stored unencrypted
 - [ ] Private data (recovery phrases, private keys) encrypted at rest
- [ ] Password only required for signing operations
+- [ ] Password required for signing, deleting a wallet, and showing a recovery
      phrase or private key
 - [ ] No secrets in `.env`, credentials, or API keys committed to repo
 - [ ] `git add -A` / `git add .` never used