I was preparing a demo of a bulk-import feature last year, the kind where you upload a CSV and the app processes a batch of records at once. I needed a realistic-looking file to show it off properly, and the fastest one available happened to be a real export from an earlier client project, sitting in a folder on my own machine from unrelated work months before.
How it ended up somewhere it shouldn't have
I renamed it to something like sample-import.csv, used it to record a demo video, and committed it into the repository as example data for anyone testing the import feature going forward, since it looked appropriately realistic and saved me the time of fabricating fake rows from scratch. The commit went into a public repository. Nobody, including me at the time, thought about where that CSV had actually come from once it had a generic-sounding filename attached to it.
What was actually sitting in that file
Real names. Real email addresses. In a couple of rows, phone numbers. All of it from a genuinely unrelated project, repurposed purely because it was convenient and looked like the kind of data the import feature was meant to handle. It sat in that public repository, under an innocuous filename, for a few weeks before I was doing an unrelated cleanup and actually opened the file to check its contents properly, at which point it was obvious immediately what I'd actually done.
Why this is such an easy mistake to make without noticing
Nothing about using a real file for a demo feels like a security decision in the moment. It feels like a shortcut for realistic-looking test data, solving a small, immediate problem. The renaming step, sample-import.csv instead of the original filename, actively made it look more innocent than it was, without anyone intending that as camouflage. It's the same pattern as a webhook URL that doesn't look like a secret: the thing itself doesn't announce what it actually is, and that's exactly why it's easy to place somewhere it shouldn't be without a second thought.
What actually changed after I found it
- The file got removed from the repository and, since it had been committed, the commit history itself needed cleaning, not just deleting the current version.
- I generate genuinely fake sample data now, fabricated names and addresses that were never real, rather than reaching for a convenient real file whenever a demo needs something realistic-looking.
- Before committing any file meant as an example or sample, I actually open it and read through its contents, rather than trusting a filename I gave it myself to describe what's actually inside.
- I went back through other repos I'd worked on for the same pattern, since if I'd done this once without noticing, it was worth checking whether I'd done it more than once.
The mistake wasn't a missing access rule or a misconfigured database. It was simpler and, in a way, more embarrassing: real data, sitting in a public place, because a convenient shortcut for a demo never got a second thought about what was actually inside the file I'd grabbed.