t3205: Address PR #2771 review feedback (quality-debt)

.agents/services/communications/discord.md

@@ -485,6 +485,10 @@ Map Discord roles to aidevops runners. Users with specific roles get routed to t
 
 ### Configuration
 
+`~/.config/aidevops/discord-bot.json` (600 permissions):
+
+> **Security**: Store `botToken` in gopass (`aidevops secret set DISCORD_BOT_TOKEN`), not in this JSON file. Reference it via environment variables or `credentials.sh`. The value below is a placeholder only.
+
 ```json
 {
   "guildId": "YOUR_GUILD_ID",

.agents/services/communications/msteams.md

@@ -741,6 +741,8 @@ Same pattern as Matrix room mappings:
 
 Matterbridge has native Microsoft Teams support via the Graph API. This is the simplest way to bridge Teams to other platforms without building a custom bot.
 
+> **Security**: Store `ClientSecret` in gopass (`aidevops secret set MSTEAMS_CLIENT_SECRET`) and inject it via environment variable substitution or a templating step. Never commit the actual secret value to `matterbridge.toml`. The value below is a placeholder only.
+
 ```toml
 # matterbridge.toml — Teams bridge configuration
 [msteams]

.agents/services/communications/urbit.md

@@ -445,16 +445,19 @@ sse.listen({
       if (data.json?.["add-nodes"]) {
         const nodes = data.json["add-nodes"].nodes
         for (const [index, node] of Object.entries(nodes)) {
-          // Runtime type check instead of unsafe type assertion
+          // Runtime type guard — validate structure before accessing properties
           const nodeObj = node as Record<string, unknown>
           if (!nodeObj?.post || typeof nodeObj.post !== "object") continue
-          const post = nodeObj.post as { author: string; contents: { text?: string }[] }
-          if (post.author !== SHIP_NAME) {
-            const textContent = post.contents
-              .filter((c: { text?: string }) => c.text)
-              .map((c: { text?: string }) => c.text)
+          const rawPost = nodeObj.post as Record<string, unknown>
+          if (typeof rawPost.author !== "string" || !Array.isArray(rawPost.contents)) continue
+          const author = rawPost.author
+          const contents = rawPost.contents as Array<Record<string, unknown>>
+          if (author !== SHIP_NAME) {
+            const textContent = contents
+              .filter((c) => c != null && typeof c === "object" && typeof c.text === "string")
+              .map((c) => c.text as string)
               .join(" ")
-            console.log(`Message from ~${post.author}: ${textContent}`)
+            console.log(`Message from ~${author}: ${textContent}`)
             // Handle command and send response...
           }
         }