Filed $DATE. Two related rules that emerged from review feedback; capturing them per the
review-derived-rules meta-pattern
so future contributors (especially agents) inherit them.
Rule 1 — Synthetic names in test fixtures, not just runtime inputs
The "Secrets & data" section of CONTRIBUTING.md says don't commit real personal data — but a
reader might infer that means runtime-input files (CSVs, exports, etc.) only. The rule needs
to be broader: test fixtures, inline data in test files, docstring examples, and sample
data in docs all fall under it too.
Specifically: any name in a tracked file should either be:
- a clearly-fictitious placeholder (
Alice Anderson / Bob Brown / Casey Cedar / etc. —
tree-themed surnames or the cryptography-tutorial Alice-Bob set are good defaults), or
- a generic role-suffixed placeholder (
Alice Coord, Bob Ref, Carol Ref), or
- an alphabetical single-letter placeholder (
Alice / Bob / Carol / Dave / Eve / …).
Never a name plausibly belonging to a specific real person in the swim community —
even as a one-off in a docstring example, even paired with a fictitious club.
Rule 2 — When scrubbing names, sweep for three patterns separately
When a scrub is required (history rewrite, fixing a leak, etc.), it's tempting to write one
regex like [A-Z][a-z]+\s+[A-Z][a-z]+ and call it done. That misses things. A safe sweep
runs three passes:
- Full multi-part names —
[A-Z][a-z]+ [A-Z][a-z]+( [A-Z][a-z]+)*
(catches Alice Anderson, Casey Cedar, Lane Larch Linden).
- First name + initial —
[A-Z][a-z]+ [A-Z]\.? (catches Alice A, Casey C.).
The tool's _is_incomplete_name-style tests are usually where these live.
- Lone first names —
\"[A-Z][a-z]+\" (anywhere a single first name is used as a test
input, e.g. _make_officials(["Alice"])). Easy to overlook because a full-name pass
already replaced the multi-part form.
After replacement, re-sweep with all three patterns before declaring clean.
Scope of the PR closing this issue
- Update
CONTRIBUTING.md → "Secrets & data" subsection to cover both rules, with examples.
- Mirror the headline of Rule 1 in
AGENTS.md (one bullet under §7 / "Secrets, data, and PII")
so agents see it without leaving the file.
- Cross-reference from the per-repo AGENTS.md template language ("test fixtures use inline
data" wording is currently silent on the synthetic-names requirement).
Filed $DATE. Two related rules that emerged from review feedback; capturing them per the
review-derived-rules meta-pattern
so future contributors (especially agents) inherit them.
Rule 1 — Synthetic names in test fixtures, not just runtime inputs
The "Secrets & data" section of CONTRIBUTING.md says don't commit real personal data — but a
reader might infer that means runtime-input files (CSVs, exports, etc.) only. The rule needs
to be broader: test fixtures, inline data in test files, docstring examples, and sample
data in docs all fall under it too.
Specifically: any name in a tracked file should either be:
Alice Anderson/Bob Brown/Casey Cedar/ etc. —tree-themed surnames or the cryptography-tutorial Alice-Bob set are good defaults), or
Alice Coord,Bob Ref,Carol Ref), orAlice/Bob/Carol/Dave/Eve/ …).Never a name plausibly belonging to a specific real person in the swim community —
even as a one-off in a docstring example, even paired with a fictitious club.
Rule 2 — When scrubbing names, sweep for three patterns separately
When a scrub is required (history rewrite, fixing a leak, etc.), it's tempting to write one
regex like
[A-Z][a-z]+\s+[A-Z][a-z]+and call it done. That misses things. A safe sweepruns three passes:
[A-Z][a-z]+ [A-Z][a-z]+( [A-Z][a-z]+)*(catches
Alice Anderson,Casey Cedar,Lane Larch Linden).[A-Z][a-z]+ [A-Z]\.?(catchesAlice A,Casey C.).The tool's
_is_incomplete_name-style tests are usually where these live.\"[A-Z][a-z]+\"(anywhere a single first name is used as a testinput, e.g.
_make_officials(["Alice"])). Easy to overlook because a full-name passalready replaced the multi-part form.
After replacement, re-sweep with all three patterns before declaring clean.
Scope of the PR closing this issue
CONTRIBUTING.md→ "Secrets & data" subsection to cover both rules, with examples.AGENTS.md(one bullet under §7 / "Secrets, data, and PII")so agents see it without leaving the file.
data" wording is currently silent on the synthetic-names requirement).