Apple Public Repo Security

When to invoke

• The repo will be public from day 1.
• An existing private repo is planning to open-source.
• A new secret is being introduced (CloudKit server-to-server key, APNs key, ASC API key).
• User asks "how do I prevent secret leaks in a public repo", "how do I configure Xcode Cloud secrets", "what to do after a leak".

Default decisions

Public commitment from day 1

• No "private first, public later" transition — there's no escape hatch to "clean history later".
• No commit in the repo's history may contain secret values, PII, or identifiable player data.
• A violation, once it happens, is treated as already leaked and the secret is rotated.

Secret classification