pre-publication-sweeplisted

Use before a repository or its content crosses the line it cannot come back from — flipping private to public, publishing an extract, pushing to a host others can read. Fires on "make it public", "open source this", "check nothing confidential leaks". Do NOT fire on a repo that is already public — its history is already out, and the task is exposure response, not a sweep — or for content that never leaves the machine.
damson/hard-won-skills · ★ 1 · Data & Documents · score 67

Install: claude install-skill damson/hard-won-skills

# Pre-publication sweep Publishing is a write with no undo: caches, forks and mirrors outlive a deletion. The deliverable is the list of commands run and their empty result — never the word "clean" on its own — or the verbatim hits, handed to the owner. ## Procedure 1. **Build the term list from the people involved, not from imagination**: personal email addresses, employer and internal project names, machine hostnames, credential prefixes (`sk-`, `ghp_`, `AKIA`). Ask the owner what is sensitive — you cannot grep for a name you were never told, and a sweep against a guessed list reports a confident false clean. 2. **Sweep the working tree**: `grep -rIiE '<terms>' . --exclude-dir=.git`, adding `--exclude-dir` for any vendored tree you will sweep as its own repo. 3. **Sweep every blob in every commit on every branch** — a file deleted years ago still publishes with the history: ```bash git rev-list --all --remotes | while read -r c; do git grep -iIlE '<terms>' "$c" done | sort -u ``` 4. **Sweep commit metadata** — messages carry names, and author/committer emails publish through `.patch` URLs and the API: `git log --all --format='%ae %ce %s' | grep -iE '<terms>'`. 5. **Re-verify on the remote, never only a local clone.** The remote is what gets published, and a clone can be stale in either direction — including showing clean where the remote is not: ```bash gh api 'repos/<owner>/<repo>/commits?sha=<branch>&per_page=1