security(docs,src): remove client tenant hostnames from the tree - #671
Merged
Conversation
This repository is public and a tenant hostname identifies a client. 27
occurrences of `<client>.alfred.black` were tracked across source, tests, docs
and the Makefile — the earliest dating to 2026-05-29.
Worst of them, and the reason this is not merely cosmetic: deploy/README.md
carried an explicit hostname-to-principal TABLE, mapping each tenant hostname
to the person it belongs to. That is replaced by a pointer to the
ALFRED_FLEET_HOSTS secret.
Almost every other occurrence was an incident reference in a comment ("On
<host> (2026-05-27) Composio finished authenticating Gmail"). The information
is worth keeping, the identity is not, so they now read "a client tenant" and
retain the date and the symptom.
Two were functional rather than prose, and were handled rather than blindly
substituted:
* Makefile's `FLEET ?=` default listed the whole roster. It is now empty,
with the roster passed explicitly or exported from the secret. The blanket
replacement had turned that line into repeated prose; caught before commit
by parsing the Makefile and exercising both the default and explicit-FLEET
paths.
* The same substitution left "the a client tenant incident" in four files.
`home.alfred.black` is deliberately untouched here — it is the operator's own
dev tenant rather than a client, and it appears far more widely (72 hits across
38 files, including test fixtures that assert on it). That is a larger sweep
and a separate decision.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
27 occurrences of
<client>.alfred.blackwere tracked across source, tests, docs and the Makefile — the earliest dating to 2026-05-29. This repository is public and a tenant hostname identifies a client.The worst one, and why this isn't cosmetic:
deploy/README.mdcarried an explicit hostname → principal table, mapping each tenant hostname to the person it belongs to. Replaced with a pointer to theALFRED_FLEET_HOSTSsecret.Almost every other occurrence was an incident reference in a comment — "On
<host>(2026-05-27) Composio finished authenticating Gmail". The information is worth keeping and the identity is not, so those now read "a client tenant" and retain the date and the symptom.Two were functional, not prose
A blanket substitution would have broken both:
Makefile'sFLEET ?=default listed the whole roster. The naive replacement turned it intoFLEET ?= home.alfred.black a client tenant a client tenant …. It is now empty, with the roster passed explicitly or exported from the secret.Both were caught before commit by actually exercising the Makefile rather than eyeballing the diff.
Smoke evidence
Makefile verified by parsing and exercising both paths, since it was the one behavioural change:
Everything else is comment-only;
ci-checkcovers the source files.Deliberately not in this PR
home.alfred.black— 72 hits across 38 files. It is the operator's own dev tenant rather than a client, and it appears in test fixtures that assert on it (process.env.DOMAIN = "home.alfred.black", avatar URLs, TwiML URLs). Scrubbing it is a larger sweep with real test churn, and whether it counts as something to hide is a judgement call I shouldn't make silently.🤖 Generated with Claude Code