diff --git a/.gitignore b/.gitignore
index 1ee471ea..646b7730 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,3 @@ playwright-report/
 coverage/
 *.tsbuildinfo
 design-source/
-cred.txt
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index f1021869..bd45020f 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -8,9 +8,10 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 /**
  * The Composio integration key is compiled into the main-process bundle so
- * no credential file ever ships with the app. It lives in the gitignored
- * cred.txt at the repository root (first line "Composio apikey: ak_...");
- * a checkout without the file builds an app whose connector features report
+ * no credential file ever ships with the app. It lives in cred.txt at the
+ * repository root (first line "Composio apikey: ak_..."), committed on
+ * purpose — private repo, and every checkout must build a configured app.
+ * A checkout without the file builds an app whose connector features report
  * the integration as unconfigured. Rotation = update cred.txt, rebuild.
  */
 function composioApiKeyForBuild(): string {
diff --git a/src/main/services/composio/composio-credentials.ts b/src/main/services/composio/composio-credentials.ts
index b16f28f3..3d1b8466 100644
--- a/src/main/services/composio/composio-credentials.ts
+++ b/src/main/services/composio/composio-credentials.ts
@@ -1,7 +1,7 @@
 /**
  * The Composio integration key ships inside the compiled main-process
- * bundle: electron.vite.config.ts reads the gitignored cred.txt at the
- * repository root during build and injects the key as __COMPOSIO_API_KEY__.
+ * bundle: electron.vite.config.ts reads cred.txt at the repository root
+ * during build and injects the key as __COMPOSIO_API_KEY__.
  * No credential file is packaged, nothing is persisted to the database, and
  * the key is never user-visible or configurable. Rotating the key means
  * updating cred.txt and rebuilding.