# Forbidden Fields

These field names and semantic equivalents must never appear in global overview payloads, frontend logs, gateway logs, redacted error messages, or contract examples.

This file is the canonical denylist and is the only place where the forbidden field names are intentionally listed.

## Infrastructure / Secrets

- `db_path`
- `local_original_path`
- `dateipfad`
- `drive_web_url`
- `drive_file_id`
- `file_id`
- `token`
- `password`
- `passphrase`
- `secret`
- `api_key`
- `oauth`
- `credentials`
- `raw_json`
- `pdf_path`

## Finance

- `amount_chf`
- `cash_value_chf`
- `total_value_chf`
- `portfolio_value_chf`
- `transaction_id`
- `merchant`
- `account_number`
- `iban`

Also forbidden by meaning:

- exact net worth
- exact cash balance
- exact portfolio value
- broker account identifiers
- wallet addresses
- transaction rows
- report file paths

## Health

- `laborwert`
- `wert_original`
- `extrahierte_inhalte`
- `dokument_name`
- `arztbericht`

Also forbidden by meaning:

- lab values
- PDF contents
- document names
- Drive links
- local health paths
- doctor report contents
- symptom notes
- diary texts
- nutrition texts
- raw Apple Health values
- raw YAZIO values

## Policy

If a future adapter receives these fields, it must drop them before creating `ModuleSnapshot` or `OverviewResponse`.

If a future exact-detail feature requires similar data, it must use a separate protected detail contract, never the global overview contract.