client-safe-sweeplisted

# client-safe-sweep — pre-send safety check for client-facing artifacts Every artifact that leaves the building gets swept first. The check battery below was built from real client engagements — including one where an early packaging pass leaked pipeline column names and rubric identifiers straight into client CSVs. It is a **checklist, not a rewrite tool**: mechanical hits get fixed on request, judgment calls always go back to the user. ## Scope Applies to anything a client, lead, or their organization will see: cover letters, proposals, quote messages, deliverable CSVs/docs, overview PDFs/MDs, client emails, demo video descriptions/captions. Does NOT apply to internal-only files (state files, session logs, private notes) — sweeping those wastes a pass. Unsure whether something is client-visible? Ask the user, don't skip it. ## Check battery | # | Check | Look for (concrete patterns) | Action | |---|---|---|---| | 1 | Secrets & infrastructure | `sk-`/key/token/secret/bearer + values; webhook/instance URLs (hosted automation domains, `admin?key=`); base/table/workflow IDs | Remove. Never paraphrase a secret into the text — cite pattern name + location only. | | 2 | Internal plumbing & methodology | Pipeline column names (internal scorer/model names, dedupe/routing slugs); vendor/actor/tool names the client wasn't sold on; internal absolute paths (`C:\Users`, `work/`, `scripts/`); prompt/rubric variable names (snake_case identifiers loose in prose) | Drop the column, reda