I worked on a code base which touched a bunch of Secret Sauce stuff but was somehow also open-sourced. One day, a patch went out to the public side which had a

I worked on a code base which touched a bunch of Secret Sauce stuff but was somehow also open-sourced. One day, a patch went out to the public side which had a bunch of internal codenames and other stuff you normally wouldn't share with the outside world. So, the people working on the project went into SVN and manually chopped it out. I started wondering what else might have been in there and went grepping for things which resembled our fairly distinctive host naming scheme. A simple regex did the trick, and while I didn't find any evidence of "prod secrets" leaking into the world, I did find something very strange in the argv parser which happened to match. There was a comparison of argv to a string which looked like base64 to me. I decoded it and it turned out to be "--WHAT" (I think, it's been a few years). Actually running "the_tool --WHAT" made it print an enormous ASCII pimp on the screen with some kind of saying underneath. The pimp itself was also base64-encoded, I think, but it was just one giant line in the source, so it didn't stand out too much. If you didn't notice the horizontal scroll bar you might not have ever seen it on a typical 80x25 display. It was something like this: if (argv == "BaSe64StRiNg==") ... (long line to decode and display it here ) ... only imagine it going on for hundreds of characters on that same line. This had been added to the depot a year or two before (long before I was on the project) and had lurked there the whole time. I don't think anyone else had any idea it was there, especially when the instigators moved on to something else. There's something to be said for reviewing existing code once in a while.