apple-public-repo-securitylisted

# Apple Public Repo Security ## When to invoke - The repo will be public from day 1. - An existing private repo is planning to open-source. - A new secret is being introduced (CloudKit server-to-server key, APNs key, ASC API key). - User asks "how do I prevent secret leaks in a public repo", "how do I configure Xcode Cloud secrets", "what to do after a leak". ## Default decisions ### Public commitment from day 1 - No "private first, public later" transition — there's no escape hatch to "clean history later". - No commit in the repo's history may contain secret values, PII, or identifiable player data. - A violation, once it happens, is treated as **already leaked** and the secret is rotated. ### Secret classification | Secret | Purpose | Storage | |---|---|---| | CloudKit server-to-server key (Key ID + PEM) | Backend API | Xcode Cloud Env Vars (Secret); locally in `~/.config/<project>/` (chmod 600) or Keychain | | App Store Connect API Key (`.p8` + Key ID + Issuer ID) | TestFlight / submission automation | Xcode Cloud Env Vars (Secret) | | APNs Auth Key (`.p8` + Key ID + Team ID) | Push notifications | Xcode Cloud Env Vars (Secret) | | Signing certificate + private key (`.p12`) | Code signing | Xcode Cloud automatic signing, hosted by Apple | | Provisioning profiles | Code signing | Xcode Cloud Apple-managed | | Player identification data | Runtime debug | OSLog `.private` interpolation; **never** committed to git | ### Things that must not enter git - The actual con