Isolating and De-Identifying a Multi-Platform Insurance Codebase

1. Background

Renovo (also stylized renovo) is Crawford's adjuster self-service suite, covering multi-platform client applications and backend microservices:

• renovo-web — Angular 17+ web portal (self-service, claims/my-teams, reports, time-sheets)
• renovo-ios — native iOS adjuster app (Swift, storyboard-based)
• renovo-android — native Android adjuster app (Java)
• renovo-api-core — .NET API / domain-core backend (FNOL, claims, assignment microservices)
• renovo-web-automation — Selenium/Appium web-automation test suite with large test-resource fixtures

The complete codebase was checked into the user's iCloud Drive (Downloads/devenv/...), where macOS and iCloud treat files as on-demand placeholders until materialized. Before the code could be migrated, it had to be:

1. Fully downloaded from iCloud (placeholders → real bytes on disk),
2. Flattened into a single code-only folder (prefix-lossless flatten), and
3. De-identified, because git history and test fixtures carried personal identity.

2. Method

2.1 Flattening

iCloud does not keep directories contiguous, so we flattened each repository into a single folder by [prefix · path · name] encoding — reversible back to the original tree, and single-folder portable:

Because flattened names embed every path segment, we preserved all directory metadata while keeping the result in one folder. We verified the flatten was complete and lossless: final file counts matched the iCloud source tree exactly (two dangling macOS symlinks in the original were the only non-copyable entries).

2.2 PII / Personal-Data Scan

We searched the extracted tree for the developer's personal identifiers: full name, corporate email, local hostname, and two hardcoded mobile numbers. Scanning was performed over:

• Text files (source code, JSON, XML, Markdown, configs) via ripgrep with multi-pattern regexes, and
• Zero-byte-safe binary surfaces (PDF test fixtures, .git reflogs) via targeted binary string substitution on fixed-length content.

2.3 Data-Set Inventory

The flat extract was also classified by file extension to identify confidential data fixtures (spreadsheets, SQL dumps, CSVs, PDFs) that hold test and claims data rather than pure source code.

3. Findings

3.1 Extract Size

3.2 PII Surfaces Found

Developer identity lived in git metadata and test fixtures, not in application logic:

Integrity Note: All scrubbed values were replaced with RFC-5737-style placeholder data of identical byte-length where possible (notably in binary PDFs), preserving document formatting and binary parsability.

3.3 Confidential Data-Set Inventory (The "Real Data" Surface)

Independent of code, the extract carried data files that must be treated as confidential test/claims datasets:

These are staging and sample datasets used to exercise the UI and API — not runtime customer production records — but they are user-identifiable via the fixtures above and should remain in the enclave extract only.

4. Scrubbing → Verification

4.1 Procedure

1. Git reflogs — Replaced developer name, email, and hostname in all 15 reflog files (5 repos × HEAD + refs/heads + refs/remotes) and .git/config with the generic Renovo Developer identity. Applied to both the flattened copy and the iCloud source, ensuring the trail is clean in the archive and origin.
2. Storyboard phone numbers — Scrubbed the two hardcoded mobile numbers to +1 555-010-0000, then re-validated XML well-formedness of both iOS storyboards.
3. Binary PDF fixture — Executed byte-length-equivalent substitution of the phone string; verified the PDF remains a valid object at 6,274,414 bytes.
4. Regression scan — Re-ran the personal-identity regex across every Renovo file.

4.2 Verification Results

5. Operational Lessons

1. Identity travels in git refs, not code. Reflogs and local git configs retain committer names, emails, and hostnames even after source code is sanitized — always scrub .git metadata explicitly.
2. Binary PII (PDFs) needs byte-length-preserving substitution. In-place binary string replacement prevents corrupted cross-reference tables in serialized binary documents.
3. Flatten-then-verify is a reliable migration pattern: A single lossless folder is portable across operating environments, and a flat extract is trivially fast to grep for residual PII.
4. Keep test fixtures classified as confidential datasets: .xlsx, .sql, and .csv files hold the highest-risk surface in an engineering handoff even when they hold only synthetic samples.

6. Author Note & Compliance

Developer identity (name, email, and machine hostname) has been completely scrubbed from all Renovo repositories — in both the local extract and the iCloud Drive source — per Section 4. No personal data or proprietary credentials are reproduced in this paper.