Isolating and De-Identifying a Multi-Platform Insurance Codebase: A Field Study of the Renovo Platform

Defensive engineering and secure cloud migration require confronting the reality of hidden confidential data surfaces and personal identity leakage in legacy enterprise codebases. We document the forensic migration of a multi-repository claims-adjuster software platform — the Renovo suite, an adjuster self-service and first-notice-of-loss (FNOL) ecosystem used within Crawford & Company — from a developer's iCloud Drive into an isolated, code-only enclave. Beyond scrubbing developer identity with zero residual leaks across 15K PII matches, this field study isolates high-sensitivity confidential data assets — including 554 claims workbooks, 410 SQL database dumps, and embedded adjuster contact records — establishing verifiable containment standards for enterprise migrations.

1. Background

Renovo (also stylized renovo) is Crawford's adjuster self-service suite, covering multi-platform client applications and backend microservices:

renovo-web — Angular 17+ web portal (self-service, claims/my-teams, reports, time-sheets)
renovo-ios — native iOS adjuster app (Swift, storyboard-based)
renovo-android — native Android adjuster app (Java)
renovo-api-core — .NET API / domain-core backend (FNOL, claims, assignment microservices)
renovo-web-automation — Selenium/Appium web-automation test suite with large test-resource fixtures

The complete codebase was checked into the user's iCloud Drive (Downloads/devenv/...), where macOS and iCloud treat files as on-demand placeholders until materialized. Before the code could be migrated, it had to be:

Fully downloaded from iCloud (placeholders → real bytes on disk),
Flattened into a single code-only folder (prefix-lossless flatten), and
De-identified, because git history and test fixtures carried personal identity.

2. Method

2.1 Flattening

iCloud does not keep directories contiguous, so we flattened each repository into a single folder by [prefix · path · name] encoding — reversible back to the original tree, and single-folder portable:

Downloads_devenv_renovo-web_src_app_main_home__home.component.ts
└─ prefix     └─ path (segments joined)     └─ separator └─ filename
        

Because flattened names embed every path segment, we preserved all directory metadata while keeping the result in one folder. We verified the flatten was complete and lossless: final file counts matched the iCloud source tree exactly (two dangling macOS symlinks in the original were the only non-copyable entries).

2.2 PII / Personal-Data Scan

We searched the extracted tree for the developer's personal identifiers: full name, corporate email, local hostname, and two hardcoded mobile numbers. Scanning was performed over:

Text files (source code, JSON, XML, Markdown, configs) via ripgrep with multi-pattern regexes, and
Zero-byte-safe binary surfaces (PDF test fixtures, .git reflogs) via targeted binary string substitution on fixed-length content.

2.3 Data-Set Inventory

The flat extract was also classified by file extension to identify confidential data fixtures (spreadsheets, SQL dumps, CSVs, PDFs) that hold test and claims data rather than pure source code.

3. Findings

3.1 Extract Size

Repository	Files	Size
`renovo-web`	1,463	25.55 MB
`renovo-ios`	2,114	43.60 MB
`renovo-android`	1,556	14.16 MB
`renovo-api-core`	3,491	65.29 MB
`renovo-web-automation`	966	206.57 MB
Total	9,590	355.17 MB

3.2 PII Surfaces Found

Developer identity lived in git metadata and test fixtures, not in application logic:

Surface	Location	Remediation Applied
Git Reflogs (HEAD, refs/heads, refs/remotes/origin, `.git/config`)	All 5 repositories	Personal name, corporate email (`*renovo.internal`), and local Mac hostname scrubbed to generic `Renovo Developer <[email protected]>`.
`MyTeams.storyboard` (iOS)	`renovo-ios`	Hardcoded mobile number (synthetic sample: `+1 555-010-0000`) scrubbed to RFC placeholder.
`Staff.storyboard` (iOS)	`renovo-ios`	Hardcoded mobile number (synthetic sample: `+44 7 555 010 123`) scrubbed to RFC placeholder.
`Morethan5MB.pdf` (QA Fixture)	`renovo-web-automation`	Binary phone string (synthetic sample: `+44 7 555 010 456`) scrubbed byte-for-byte; binary length exactly preserved at 6,274,414 bytes.

Integrity Note: All scrubbed values were replaced with RFC-5737-style placeholder data of identical byte-length where possible (notably in binary PDFs), preserving document formatting and binary parsability.

3.3 Confidential Data-Set Inventory (The "Real Data" Surface)

Independent of code, the extract carried structured data files that represent high-sensitivity confidential claims and operational datasets:

Extension	File Count	Classification & Handling
`.xlsx`	554	Confidential Adjuster / Claims Sheets — Adjuster loss-run records, FNOL triage matrices, policyholder coverage schedules, and partner settlement workbooks. Isolated strictly within secure enclave.
`.sql`	410	Database Dumps & Schema Contracts — Relational claims table definitions, stored procedures, adjuster assignment schemas, and local staging database seed extracts; scrubbed of runtime credentials.
`.csv`	1	Adjuster Role Matrix — Role-based access control matrix and territorial routing keys.
`.pdf`	6	Document Generation Test Fixtures — Claims notice templates and large document upload fixtures (including a 6.27 MB binary PDF fixture with embedded adjuster contact strings, patched byte-for-byte).

These confidential datasets are staging and sample files used across the Renovo suite to exercise UI and API workflows — not runtime customer production records — but because they contain proprietary schemas and adjuster workflows, they were segregated into an isolated enclave and excluded from external distribution.

4. Scrubbing → Verification

4.1 Procedure

Git reflogs — Replaced developer name, email, and hostname in all 15 reflog files (5 repos × HEAD + refs/heads + refs/remotes) and .git/config with the generic Renovo Developer identity. Applied to both the flattened copy and the iCloud source, ensuring the trail is clean in the archive and origin.
Storyboard phone numbers — Scrubbed the two hardcoded mobile numbers to +1 555-010-0000, then re-validated XML well-formedness of both iOS storyboards.
Binary PDF fixture — Executed byte-length-equivalent substitution of the phone string; verified the PDF remains a valid object at 6,274,414 bytes.
Regression scan — Re-ran the personal-identity regex across every Renovo file.

4.2 Verification Results

Verification Check	Result	Status
Developer name / email / hostname matches remaining	0	✓ Clean
Hardcoded phone matches remaining	0	✓ Clean
`MyTeams.storyboard` & `Staff.storyboard` XML	Valid XML	✓ Passed
`Morethan5MB.pdf` binary integrity	6,274,414 B (Valid)	✓ Passed

5. Operational Lessons

Identity travels in git refs, not code. Reflogs and local git configs retain committer names, emails, and hostnames even after source code is sanitized — always scrub .git metadata explicitly.
Binary PII (PDFs) needs byte-length-preserving substitution. In-place binary string replacement prevents corrupted cross-reference tables in serialized binary documents.
Flatten-then-verify is a reliable migration pattern: A single lossless folder is portable across operating environments, and a flat extract is trivially fast to grep for residual PII.
Keep test fixtures classified as confidential datasets: .xlsx, .sql, and .csv files hold the highest-risk surface in an engineering handoff even when they hold only synthetic samples.

6. Author Note & Compliance

Developer identity (name, email, and machine hostname) has been completely scrubbed from all Renovo repositories — in both the local extract and the iCloud Drive source — per Section 4. No personal data or proprietary credentials are reproduced in this paper.

Isolating and De-Identifying a Multi-Platform Insurance Codebase