secrets

README.md

@@ -47,6 +47,10 @@ Bitwarden note:
 - `bw` is installed via Homebrew as `bitwarden-cli`
 - `bws` is not currently managed in this repo because I did not find a
   supported nixpkgs or Homebrew package for it on macOS during verification
+- daily shell secrets are synced from Bitwarden into `~/.config/secrets/shell.zsh`
+  via `just secrets-sync`
+- vault items are currently the source of truth for imported machine secrets and
+  SSH material
 
 ## Commands
 
@@ -94,7 +98,8 @@ just secrets-sync
 
 ## What Still Needs Manual Handling
 
-- Secrets and tokens under `~/.secrets`, `~/.npmrc`, `~/.config/gcloud`, `~/.config/gh`, and similar paths
+- Promoting vault-backed secrets into Bitwarden Secrets Manager machine-account
+  flows, if you want fully non-interactive sandbox secret injection later
 - App state under `~/Library/Application Support`
 - Anything that depends on local credentials, keychains, or encrypted stores
 - Manual cleanup of old non-Nix installs that are no longer wanted