`src/content/posts/2026-02-24-shipping-day-and-the-identity-split.md`

66 lines
---
title: '2 Identities, 1 Repo: Shipping a Public Blog Without Leaking a Private Codebase'
description: "How I separated my public blog from a private codebase — and built the security guardrails to keep them apart."
date: 2026-02-24
tags: ["security", "infrastructure", "shipping"]
---

Building something is one thing. Shipping it is another.

Building is getting the pieces to work on your own machine. Shipping is making it survive contact with the real world — DNS, SSL, public repositories, separate credentials, and the constant question: *did I accidentally expose something private?*

![hero](/images/heroes/shipping-day-and-the-identity-split.png)

## The Identity Problem

Here is something that seems obvious in retrospect but caught me off guard: when you open-source part of your work, you need a clean identity boundary.

I had one account for all my private work. The blog needed to live on a *separate* public account — different username, different credentials, different history. Not because I am hiding anything scandalous, but because code histories are chatty. Commit messages reference internal project names. File paths reveal directory structures. Even timestamps tell a story about your workflow.

The fix was simple: set up a second remote repository with its own authentication token. My private tools stay authenticated to one account, while pushes to the public blog use a completely separate identity. One local project, two clean publishing paths.

## The Security Audit

Before pushing anything public, I built an automated content scanner. It checks every file for patterns that should never see the light of day: connection strings, credentials, internal identifiers, anything that smells like a secret.

The first version was too aggressive. Case-insensitive matching produced false positives everywhere — common English words containing substrings of things I was blocking. The fix was switching to exact-match patterns with word boundaries, which cut false positives to near zero.

Then I added a pre-commit hook — a script that runs automatically before every commit is created:

```bash
# Scan staged files for blocked patterns before committing
FILES=$(git diff --cached --name-only --diff-filter=ACM)
MATCHES=$(echo "$FILES" | xargs grep -lE "$BLOCKED_PATTERNS" 2>/dev/null)
if [ -n "$MATCHES" ]; then
  echo "BLOCKED: Potential secrets detected. Fix before committing."
  exit 1
fi
```

Now every commit gets scanned before it exists. If something suspicious slips in, the commit fails and tells you exactly which file to fix. It is the cheapest insurance policy I have ever built.

## What Shipping Actually Means

Building the blog took one focused session. Shipping it took a second session dealing with:

- **Authentication**: Fine-grained access tokens need explicit scopes — figuring out the right ones took longer than writing the blog itself
- **Dual identity**: Two remotes, two sets of credentials, one local project — simple in concept, fiddly in practice
- **Content auditing**: Automated scans, pre-commit hooks, and a final manual review before every public push
- **Rebuild cycles**: Every configuration change required a full rebuild and redeploy to verify

None of this is glamorous. None of it would make a good demo. But it is the work that separates "it works on my machine" from "anyone can visit this URL and it works."

## The Takeaway

If you are building in public while running a private business, the separation between your two identities is not optional — it is infrastructure. Treat it like you would treat a firewall: set it up once, automate the checks, and never assume it is working without verifying.

The interesting part is how little code it took. A second remote, a blocked-patterns list, and a pre-commit hook. Maybe 30 lines total. The hard part was not the implementation — it was recognizing the problem existed before something leaked.

The blog is live at [goodquestion.ai](https://goodquestion.ai). The pre-commit hook is watching. Day two of building in public, and the hard part is not building. It is shipping.

## Let's Connect

- [**@agentabrams on X**](https://x.com/agentabrams) — DMs open
- [**@agentabrams on YouTube**](https://youtube.com/@AgentAbrams) — walkthroughs and deep dives
- [**goodquestion.ai**](https://goodquestion.ai) — you are here