Two real values were published to this repo and later removed from the working tree in #9. Both remain in git history, and clearing them requires a decision only the repo owner can make.
What is in history
| commit |
value |
why it matters |
0def0c8 |
A real treating provider's surname in WISHLIST.md |
Combined with the author's name in LICENSE and the ADRs, discloses a care relationship |
6fc9d1b |
A real ~85-char document ID in messages.md, plus the name of the uploaded file |
A live handle into the author's chart |
Both were removed from the working tree on 2026-07-29. Neither was caught by the 2026-05-10 history rewrite because neither existed yet.
Reproduce with:
python3 scripts/phi-scan.py --history
Why this is not already fixed
The 2026-05-11 cleanup worked by publishing a fresh repo that had never contained the bad commits — no force-push, no GitHub GC problem, no support ticket. That path is no longer available. This repo is public with 6 stars and 1 fork, so a rewrite now means:
- Force-pushing rewritten history to a public repo
- Breaking the existing fork and every clone
- Old SHAs remaining reachable via direct URL until GitHub GCs unreferenced objects, which needs a support request to expedite
Options
- Leave it. A provider surname and an opaque document handle, in commits nobody browses. Lowest disruption, and the working tree is clean.
- Rewrite history. Fully removes them, at the cost of the fork and every clone, plus a GitHub support ticket to expedite GC.
- Rewrite and re-publish fresh, as in 2026-05-11 — loses stars, fork, and issue history.
No recommendation here on purpose. The disclosure is modest, the remedy is disruptive, and the tradeoff is the owner's to weigh.
Preventing recurrence
Already handled in #9: scripts/phi-scan.py checks the working tree and reports history separately, and it is wired into docs/release-checklist.md. Both known leaks are named in the script's docstring so the next reader does not need this backstory.
Background: docs/postmortems/2026-07-29-send-message-compose-chain.md, "PHI found in the public repo".
Two real values were published to this repo and later removed from the working tree in #9. Both remain in git history, and clearing them requires a decision only the repo owner can make.
What is in history
0def0c8WISHLIST.md6fc9d1bmessages.md, plus the name of the uploaded fileBoth were removed from the working tree on 2026-07-29. Neither was caught by the 2026-05-10 history rewrite because neither existed yet.
Reproduce with:
Why this is not already fixed
The 2026-05-11 cleanup worked by publishing a fresh repo that had never contained the bad commits — no force-push, no GitHub GC problem, no support ticket. That path is no longer available. This repo is public with 6 stars and 1 fork, so a rewrite now means:
Options
No recommendation here on purpose. The disclosure is modest, the remedy is disruptive, and the tradeoff is the owner's to weigh.
Preventing recurrence
Already handled in #9:
scripts/phi-scan.pychecks the working tree and reports history separately, and it is wired intodocs/release-checklist.md. Both known leaks are named in the script's docstring so the next reader does not need this backstory.Background:
docs/postmortems/2026-07-29-send-message-compose-chain.md, "PHI found in the public repo".