App Ops Desk · Issue #28

Secrets and config hygiene at release

The scariest release bugs are not crashes — they are staging URLs, debug menus, and keys that should never have left your laptop.

Read time: 6 min Security Config Pairs with Issues #11 and #19
One action this week: Search the Release binary config for staging hosts, debug flags, and test keys. Fix before upload, not after a stranger finds them.

Audit list

  • Base URL is production
  • Analytics/write keys are prod
  • Debug menu disabled or compile-stripped
  • Logging level not verbose in Release
  • Feature flags default safely if remote config fails
  • No secrets in git history you just printed in a ticket

Failure modes

  • xcconfig mixup: Debug values in Release
  • CI injecting staging secrets on main
  • “Temporary” bypass still compiling
  • Test StoreKit configuration shipping to users

Release log

Config audit build ____:
API host:
Debug menu: off
Keys: prod
Flags defaults safe: yes/no

Bottom line

Archive is a publication. Treat config like code you are proud to publish — because you are.

Resources hub → Full library and jump-by-symptom links. Join the App Ops Desk waitlist Weekly release ops for people who ship alone.