diff --git a/AUDIT-SECRETS.md b/AUDIT-SECRETS.md
new file mode 100644
index 0000000..cd29609
--- /dev/null
+++ b/AUDIT-SECRETS.md
@@ -0,0 +1,24 @@
+# Security Audit: Secrets & Configuration
+
+## Summary
+
+A security audit was performed on the codebase to identify any exposed secrets or insecure configurations. The audit involved both manual review and automated scanning of the entire repository.
+
+## Findings
+
+**No exposed secrets or configuration vulnerabilities were found in the codebase.**
+
+### Secret Detection
+
+- **Automated Scanning**: A `grep` command was used to search for common secret patterns, such as API keys, passwords, and tokens. No hardcoded secrets were found.
+- **Manual Review**: A manual review of the entire codebase was conducted, with a focus on configuration files, source code, and example files. This review did not uncover any exposed secrets.
+
+### Configuration Security
+
+- **CLI Analysis**: The command-line interface, defined in `cmd/trix/main.go`, was reviewed for security misconfigurations.
+- **No Insecure Defaults**: The CLI does not have any insecure default settings, such as debug modes or overly verbose error handling, that could expose sensitive information.
+- **No Unnecessary Services**: The application does not run any unnecessary services or open any network ports, which reduces the potential attack surface.
+
+## Conclusion
+
+The codebase is considered to be free of exposed secrets and insecure configurations.