Screenshot fixtures contain the owner's real network name, location and personal tool strings #52

New issue

Closed

opened 2026-10-01 16:24:10 +08:00 by Breadway · 1 comment

Breadway commented

2026-10-01 16:24:10 +08:00

Owner

What

The sample data breadbar seeds for its --screenshot views (the stage and surtitle captures that bread-capture drives) is built from real, personal data instead of neutral placeholders. Every published capture of those views carries it.

On main (4c06335) the fixtures include:

A real Wi-Fi network name (an identifiable school network) in the stage status sentence and a notification history entry. See src/main.rs (the set_status(...) call in the screenshot setup), src/stage/mod.rs (seed_sample_notifications), and the status_sentence test in src/stage/pure.rs.
A real city in the example flight widget tooltip (screenshot_sample_widgets in src/main.rs).
Personal AI tool strings: an AI-assistant usage widget and three "waiting for your input" notifications (src/main.rs, src/stage/mod.rs, plus a pure.rs test).
Real artist and track names for the media fixture.

Why it matters

These captures are produced so they can be shown publicly (docs, the bos.breadway.dev site, trailers). The network name plus the city pin down where the owner studies and lives.

How it was found

While capturing the spotlight stage for the BOS trailer, the fixture text appeared in the stage, notification history and pill widget captures. Confirmed by grepping the source on main. The trailer avoided it by building a private copy with neutralised fixtures.

Confidence

High. Read directly in the source on main. Reproduced in a capture.

Suggested fix

Replace every fixture with neutral placeholders, for example "Home Wi-Fi", a build-timer widget instead of the flight, a disk-usage widget instead of the AI-usage one, "cargo build finished" for the notifications, and an invented artist and track. Update the matching pure.rs tests. Consider a test that fails if fixture strings match a small denylist.

## What The sample data breadbar seeds for its `--screenshot` views (the stage and surtitle captures that bread-capture drives) is built from real, personal data instead of neutral placeholders. Every published capture of those views carries it. On `main` (4c06335) the fixtures include: - **A real Wi-Fi network name** (an identifiable school network) in the stage status sentence and a notification history entry. See `src/main.rs` (the `set_status(...)` call in the screenshot setup), `src/stage/mod.rs` (`seed_sample_notifications`), and the `status_sentence` test in `src/stage/pure.rs`. - **A real city** in the example flight widget tooltip (`screenshot_sample_widgets` in `src/main.rs`). - **Personal AI tool strings**: an AI-assistant usage widget and three "waiting for your input" notifications (`src/main.rs`, `src/stage/mod.rs`, plus a `pure.rs` test). - Real artist and track names for the media fixture. ## Why it matters These captures are produced so they can be shown publicly (docs, the bos.breadway.dev site, trailers). The network name plus the city pin down where the owner studies and lives. ## How it was found While capturing the spotlight stage for the BOS trailer, the fixture text appeared in the stage, notification history and pill widget captures. Confirmed by grepping the source on main. The trailer avoided it by building a private copy with neutralised fixtures. ## Confidence High. Read directly in the source on `main`. Reproduced in a capture. ## Suggested fix Replace every fixture with neutral placeholders, for example "Home Wi-Fi", a build-timer widget instead of the flight, a disk-usage widget instead of the AI-usage one, "cargo build finished" for the notifications, and an invented artist and track. Update the matching `pure.rs` tests. Consider a test that fails if fixture strings match a small denylist.

Breadway added the

bug

privacy

labels

2026-10-01 16:24:10 +08:00

Breadway referenced this issue from a pull request that will close it,

2026-10-01 16:49:43 +08:00

fix(screenshots): use neutral sample fixture data #53

Breadway commented

2026-10-01 17:46:59 +08:00

Author

Owner

Implementation is available in PR #53 at 2e5398343f2ef2760b90db37f6575d3464d534b3. Local checks passed: cargo test --offline -p breadbar (128 tests) and Clippy. Exact-head CI is pending and waiting to run; if it fails, move this item back to TODO.

Implementation is available in PR #53 at `2e5398343f2ef2760b90db37f6575d3464d534b3`. Local checks passed: cargo test --offline -p breadbar (128 tests) and Clippy. Exact-head CI is pending and waiting to run; if it fails, move this item back to TODO.

Breadway closed this issue

2026-10-02 17:05:37 +08:00