From ac5e408f6523bbbbe3a9d7c91c4ed6df597b2239 Mon Sep 17 00:00:00 2001 From: daviduuuul Date: Sun, 21 Jun 2026 21:07:58 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20add=20privacy=20rule=20=E2=80=94=20neve?= =?UTF-8?q?r=20leak=20private=20setup=20into=20the=20public=20repo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codifies the standing instruction: no personal paths, real hub config, hook names, secrets, or other-project names in any tracked file. The repo ships only the product + public tooling; private working docs stay in gitignored research/ or .scratch/. Prevents a repeat of the hub paths that leaked into the benchmarks. Co-Authored-By: Claude Opus 4.8 (1M context) --- CLAUDE.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 4ce5684..e096780 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -71,6 +71,23 @@ what the plugin does changes) and benchmark-true (no measured edge the A/B doesn show). The version badge is one of the four synced manifests — `npm run bump` moves it, never hand-edit. +## Privacy — never leak private things into the public repo (owner's standing instruction) + +This is a **public repo**. Nothing about the owner's private setup belongs in any tracked file +— code, tests, benchmarks, corpora, or docs. Before committing, never include: +- personal paths (`C:\Users\\…`) or the private hub (`C:\ClaudeCode\…`); +- real hook/guard script names, real `settings.json`/MCP config, `MEMORY_FILE_PATH`, or any live + config from the owner's machine — synthetic corpora use **generic placeholders** + (`./hooks/*.ps1`, `$CLAUDE_CONFIG_DIR`, `./memory.jsonl`, `C:\path\to\…`, `$env:TEMP\…`); +- secrets / tokens / keys, even in examples (use `${ENV_VAR}` placeholders); +- names of the owner's other projects. + +The repo ships **only the product and its public tooling**: the plugin (`whippet/` — skill, +commands, hooks, scripts), the marketplace wrapper, the dev tooling, and benchmarks with sanitized +synthetic data. Private working docs (ideas, roadmaps, research, scratch notes) stay **out of git**, +under the gitignored `research/` or `.scratch/` dirs — never committed. (See `.gitignore`.) This +complements *fixtures stay private* above: when in doubt, sanitize or keep it local. + ## Scope discipline (this repo, of all repos) Whippet's value is a **narrow** scope: leanness where it pays — *the least that actually works,