Something Private Ended Up Somewhere Public

The failure these share

Not an incident anyone was paged for. A field that crossed a boundary, in a response that looks exactly like every other response.

• Next.js Server Prop Leak Verdict — measured: a server-only token in the page source, no `NEXT_PUBLIC_` involved, in a field the client never reads, invisible to a JS-bundle scan.
• PII Redaction Auditor — redaction tools report what they removed. Nobody can see what they failed to remove.
• Rights-Aware Export — an export that completes successfully and ships material the buyer had no right to receive.
• HTTP Cache Semantics — a response marked private, stored in a shared cache, serves one user's page to another.
• Secret Scan Triage — a Twilio Auth Token is 32 lowercase hex, the same shape as an MD5 digest.
• Bidi Text Safety — source that reads as safe and compiles as something else.

Why buy them together

Each one is a different boundary — render, log, export, cache, repo, review. Closing one and leaving the others is how the same class of disclosure moves one layer over.

Each ships with its own tests and is sold separately. This is the set, below the sum.