App Ops Desk · Issue #28
Secrets and config hygiene at release
The scariest release bugs are not crashes — they are staging URLs, debug menus, and keys that should never have left your laptop.
One action this week: Search the Release binary config for staging hosts, debug flags, and test keys. Fix before upload, not after a stranger finds them.
Audit list
- Base URL is production
- Analytics/write keys are prod
- Debug menu disabled or compile-stripped
- Logging level not verbose in Release
- Feature flags default safely if remote config fails
- No secrets in git history you just printed in a ticket
Failure modes
- xcconfig mixup: Debug values in Release
- CI injecting staging secrets on main
- “Temporary” bypass still compiling
- Test StoreKit configuration shipping to users
Release log
Config audit build ____: API host: Debug menu: off Keys: prod Flags defaults safe: yes/no
Bottom line
Archive is a publication. Treat config like code you are proud to publish — because you are.
Resources hub → Full library and jump-by-symptom links. Join the App Ops Desk waitlist Weekly release ops for people who ship alone.