diff --git a/SECRETS.md b/SECRETS.md
index 8995a88..90a78b9 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -1,25 +1,33 @@
 # Secrets — not stored in this repo
 
-Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers.
+Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 
 ## Map
 
-| What | Where (mirror) | Where (live) |
-|------|----------------|--------------|
-| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa |
-| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` |
-| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container |
-| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` |
-| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` |
-| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files |
+### Taler — host `/root`
+
+| What | Mirror (`koopa-admin-secrets/…`) | Live |
+|------|----------------------------------|------|
+| Bank admin/exchange/explorer/demo/bench | `koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` |
+| Merchant instance goa-demo | `koopa/host-root/taler-merchant/…` | `/root/merchant-*-password.txt` |
+| Exchange ATTRIBUTE_ENCRYPTION_KEY | `containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | container `/etc/taler-exchange/secrets/` |
+| Exchange wire / DB | `…/*.secret.conf` (+ `.example` templates) | same under container |
+
+### Apps — `/home/hernani/`
+
+| What | Mirror | Live |
+|------|--------|------|
+| Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
+| Bonfire | `koopa/home-hernani/koopa-bonfire/{.env,users.env}` | `~/koopa-bonfire/` |
+| Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
 
 ## Rules
 
-- **koopa-admin-log** may document *paths* and use `@inline-secret@` only.
-- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex.
-- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`.
+- **koopa-admin-log**: paths only; `@inline-secret@` in configs, never password/key material.
+- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`
+- Full inventory: `koopa-admin-secrets/MAP.md`
 
-## Public (OK in this repo)
+## Public (OK here)
 
-- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`)
+- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange public master key)
 - Port maps, unit ladders, non-secret overrides