Posts on Privacy.
6 posts tagged "Privacy".
The privacy work isn't on the /privacy/ page
The /privacy/ page went live in June and covers what it covers. The actual privacy work on this site happened in a data-locality choice, a brand-separation rule, and a username leak in published MDX. Only one of the three announced itself.
GA4 saw nothing for four days. The fix was gated behind the consent it was meant to make optional.
The Consent Mode v2 default that was supposed to fire for every visitor lived inside a function that only ran after someone clicked Accept. So first-time visitors loaded no analytics at all, and GA4 recorded nothing.
Four lines in a published article leaked my macOS username to the live site
PR #17 was a four-line diff across two files. One of those lines was in the body of a published article, rendering a real macOS username in the browser. The fix was substitution — but the pattern it revealed was wider: three surfaces in the same audit window, the same failure.
I patched the same privacy leak four times. The lesson isn't to be more careful.
Private repo names in a language stats page. A macOS username in a published plist example. A missing privacy policy when the newsletter went live. Four separate fixes, each reactive, each after deployment. Four is enough to name the pattern: the publish boundary has no scrubber.
The identifiers I didn't know I'd published
Five fixes across /learning, /now, a published article, the privacy policy page, and a global pre-commit hook — all tracing back to the same root cause. Not tracking, not data harvesting. Just private names in places I'd stopped looking.
The privacy policy was correct. The article body wasn't.
A production audit found the macOS username in a published plist example and private project names on two public pages. Neither would have been caught by a policy document. The fix was a pre-commit hook and an aggregation change — pipeline enforcement that runs whether the author remembers or not.