Case 06 · Release safety

11 leak alerts, 0 leaks

“To secure ourselves against defeat lies in our own hands, but the opportunity of defeating the enemy is provided by the enemy himself.”

Sun Tzu · The Art of War, IV.2, tr. Lionel Giles, 1910 (Project Gutenberg)

Two public plugin libraries of mine push straight to main, with no pull requests and no CI. A private term list of 50 rules, kept off GitHub, is the only thing between a draft and the public. On 3 Oct the first full scan raised 11 alerts, and none was a leak: 9 came from one rule that matched too much. The one real policy hit came the same night, through a path that had no check at all. Now a gate scans every new commit on every public branch every 15 minutes.

0:00 / 1:18

Status · Running · logged 3 to 8 OctThe gate logged 960 scans, 3 to 8 Oct, 0 hits (3 Oct 8:35 PM CT to 8 Oct 8:20 PM CT). The scrub for the one real hit was written and held for my review. The rule that over-matched is still broad; reviewed public contexts are allowed by a list kept off GitHub.

01 · The claim

The gate, in four numbers

0 of 11

0 of 11 alerts were real leaks, on the first full scan of every tracked file on 3 Oct.

9 of 11

Alerts from one rule meant for a name next to an email. Its .* ran across the line to the @ of a plugin install command.

15 min

How often the gate fetches every public branch and scans each new commit, added lines and message.

960

960 scans, 3 to 8 Oct, 0 hits. It alerts when it cannot scan, too.

02 · Transcript

Transcript

0:01Two public libraries push straight to main. A private list of 50 rules guards them.

0:14The first full scan, on 3 Oct, raised 11 alerts. None was a leak.

0:20Nine came from one rule: a name, then .* reaching any @ on the line.

0:31The real hit came that night, from a queue that pushed with no check.

0:37The push job for that library failed closed and refused to push.

0:41The scrub was written and held for my review.

0:46Now a gate scans every new commit on every public branch.

0:52It never prints a term, and it alerts when it cannot scan.

1:00960 scans, 3 to 8 Oct, 0 hits.

1:06The over-broad rule stays. Reviewed public contexts are on an allow list.

03 · Sources

Sources and honest limits

REV Leak review of the public plugin library, main at 39f6fe7, 3 Oct 2026 (private; terms masked)
GATE Gate script and its log, 3 to 8 Oct 2026 (private)
GIL Sun Tzu, The Art of War, chapter IV, verse 2, translated by Lionel Giles, 1910, Project Gutenberg ebook 132: https://www.gutenberg.org/ebooks/132

The real hit was two names of third-party agents inside text quoted from a public marketplace listing; nothing private was described, but my list bans both. It reached main through a catch-up queue that pushed without the private check. The push job for that library refused to push again until it was fixed, which is the fail-closed part. Purging old commits would need a history rewrite and a force push, and copies already fetched stay out of reach, so the gate exists to catch things before that. The scan never prints a matched term. Term lists and allow lists stay off GitHub.

Poured in gold.