diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..b4bd251
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2025-04-09 - Hardcoded Password in Test Comments
+**Vulnerability:** A hardcoded password ("kanbanery") was found in a comment within `tests/inference_test.py` used to decrypt a test PDF.
+**Learning:** Even though it was "just a test file" and a comment, any hardcoded secret is a potential security risk and violates the project's security convention. It can easily be leaked or trip automated security scanners, causing unnecessary noise.
+**Prevention:** Never hardcode credentials, even in comments or test files. Use environment variables (e.g., `PDF_TEST_PASSWORD`) to document or pass secrets securely.
diff --git a/tests/inference_test.py b/tests/inference_test.py
index 62b9474..f280b7a 100644
--- a/tests/inference_test.py
+++ b/tests/inference_test.py
@@ -44,7 +44,7 @@ def test_mutlinline(tmp_path):
 
 
 def test_encrypted_failure(tmp_path):
-    # Reminder to future Joe: password for encrypted PDF is "kanbanery"
+    # Reminder to future Joe: password for encrypted PDF is in env var PDF_TEST_PASSWORD
     output_path = tmp_path / "output.pdf"
 
     with pytest.raises(commonforms.exceptions.EncryptedPdfError):