# SAFE INTAKE — how to send material for the $500 assessment

**Do not send live credentials, API keys, private keys, customer records, or production data.**

The assessment needs the **shape** of your tool surface, not the secrets inside it.

## 1. What to send

- A `tools/list` JSON response, or a bare list of tool definitions.
- For each tool: name, description, and `input_schema`.
- Optionally: the policy you think you have, and one read-only repository link.
- The signed authorization form and the completed intake.

## 2. What not to send

- `.env` files, `~/.aws/credentials`, private keys, bearer tokens, session cookies.
- Customer records, production database dumps, or personal data.
- A live production endpoint that we did not agree to test.

## 3. Redact before you send

Replace every secret value with a placeholder and keep the schema shape. Tool names, descriptions and
input schemas are enough. **Read the file once before you send it.**

We run a redactor again on receipt. It is a safety net, not a guarantee. If it finds a live secret, we
stop, delete the file, and ask you to rotate the secret and send a clean copy.

## 4. Send through the agreed channel

- For the $500 assessment, the default channel is email to vincent@firmeai.com.
- **Email is not encrypted by CAIN.** Do not describe it as encrypted. If your policy requires
  encryption, agree on a channel before sending (for example, an encrypted archive whose key is sent
  separately, or your own secure file share).
- If you accidentally send a live secret: rotate it immediately, tell us, and send a redacted copy.
  We will delete the message and the copy we received.

## 5. What happens to the material

- Used only for this engagement.
- Stored in an access-controlled directory.
- Deleted 90 days after delivery unless you ask for retention in writing.
- Not used to train a model.
- Not shared with another customer.

## 6. What the assessment does not need

- Production access.
- A running server.
- Your source code (unless separately agreed).
- Any credential.

If a request from us would require a credential, stop and ask why. The static assessment should not
need one.