Developer finds 374 of 412 privacy scan hits traced to one repeated line of build tooling

A developer running a pre-publication privacy scan on a code repository flagged 412 hits across 16 files, initially suggesting widespread issues requiring extensive review. Closer analysis revealed 374 of those hits were the same single line — a build tool emitting an absolute home directory path — repeated across 208 logged control runs. Rather than resetting the append-only log to hide the leak, the developer chose to exclude the private log from publication and start a fresh public log using a relative path token, preserving the integrity of both records. The generator was fixed to emit a repo-relative token instead of an absolute path, resolving the root cause with one code change. The incident highlighted that build tools and test harnesses, unlike application code, are rarely reviewed for what they write into permanent logs.