A rule may say where a secret lives, never the secret itself, for example a rule titled Database password with the text Kept in the SyncNow vault. Hosting and database passwords stay in the SyncNow server's vault, the server uses them when it runs the agents' operations, and agents never receive them.
Every agent working on the project receives all the rules, when it opens the project and again with its writes, so anything written there is widely shared. As a safety net, everything sent to the project program passes through SyncNow's secret redaction: text that looks like a credential, or matches one already stored for the project, is replaced by a placeholder, and the AI check receives only redacted text.
Redaction recognises patterns and known values, so it is not a reason to type a secret. If a secret got through anyway, treat it as exposed and change it where it is issued: removing the rule takes it out of the current view, but the project journal is append-only and keeps the earlier state. To give SyncNow a password, use Connections (Save hosting connection, Add database), where a saved hosting password shows only as Stored securely.