{
  "id": 2800885,
  "title": "Protected nothing",
  "url": "https://urgent.news/2026/08/23/protected-nothing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-23T13:52:56.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/thekilteddev/protected-nothing-2fgc"
  },
  "original_language": "en",
  "account": "The proof-of-concept food-diary tool, not an official NHS product, was built to address privacy concerns during a collaboration with an NHS dietetic team. Despite having a privacy guardrail, the repository remained inaccessible to the public, as the guardrail protected nothing that going public would have exposed. The one rule holding back the repository's public migration was the requirement to prevent identifiable data from leaking through free-text fields, such as client descriptions. However, this risk was minimal, as the client descriptions were stored locally and never uploaded to the repository. The repository's privacy settings were deemed insufficient to protect the application code from being publicly accessible, as the code was already being downloaded by visitors in unminified form. Additionally, there were 40 files outside the application folder which were never served to visitors and hidden by the repository's private status, including sensitive information like a hosting-account username. The fix implemented for the public repository involved separating the repository into one private and one public, with the public repo only containing the application directory's contents. This approach prevented any sensitive files from leaking through the repository's history. The guardrail's actual protection lies within the free-text field, which remains a concern regardless of repository visibility, as it is a property of what the app allows users to type rather than who can see the code.",
  "summary": "Field notes from a proof-of-concept food-diary tool built alongside one NHS dietetic team, not an official NHS product, no patient data anywhere in it. A privacy guardrail blocked its repository from going public. Traced through the code, it protected nothing that going public would have exposed. A rule sounded exactly right, protected exactly nothing, and stood as the one thing blocking real…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}