Shipping code from a working fleet without shipping its secrets

Shipping2026-10-29

Our kits come from code that runs our own fleet, where configuration files hold API keys, tokens, mailbox passwords and account ids. A kit that leaks one of them would be worse than no kit at all, so nothing is zipped until three scanners on three machines have found nothing.

What goes in

The packager copies only the files a kit's manifest names, never a whole folder, and leaves out caches, backups and version-control history. Examples and tests use invented products and figures, never ours.

The scans

• On the build machine: the staged files are searched for the actual values of the fleet's secrets (132 at the last build) and for the SHA-256 fingerprints of 16,259 secret strings from our workstation. Only fingerprints travel; the workstation's secrets never leave it.
• On two more machines: the same files are sent to each and searched there against the secrets that machine holds (498 and 129 values), then deleted.
• Everywhere: patterns for key formats, private addresses and personal data.
• Before any of it counts: each scanner first runs on planted canaries and must find all of them, 23 per run, or the build stops.

A finding stops the build. Once a version has been sold it is never rebuilt: a fix ships as a new version, so the file a buyer downloads is the file that was scanned.

The false alarms that taught us the most

• A comment that began "Each pass ends with" was flagged as a Gmail app password. Those passwords are four groups of four letters, and so is that phrase. We reworded the comment.
• The shared address range 100.64.0.0/10, which carrier-grade NAT and Tailscale use, was flagged as a private address.
• A systemd unit name like [email protected] looked like an email address, and a placeholder store id like 9NXXXXXXXXXX looked like a real product.

The comment we reworded; the other three were allowed for that one kit and that one pattern, never globally, so the next kit is scanned as strictly as the first. A false alarm costs a minute, and a missed key would cost much more.

Every kit on sale went through this, with zero findings at each release.