testnet/policies/data-retention.md: clarify that testnet is not a place to store anything resembling real user data #851

Activity

1. phertyameen

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   security

   testnet

   good-first-issue

   on Oct 15, 2026
2. drips-wave

   added

   Stellar WaveIssues in the Stellar wave programIssues in the Stellar wave program

   on Oct 17, 2026
3. tim-dev212 commented on Oct 17, 2026

   

   tim-dev212

   on Oct 17, 2026 – with Drips Wave

   More actions

   @tim-dev212 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   Hi, I can take this on and make the data-retention policy clear and practical. Please assign this to me.

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @tim-dev212 to this issue.
4. Manager-dev1515 commented on Oct 17, 2026

   

   Manager-dev1515

   on Oct 17, 2026 – with Drips Wave

   More actions

   @Manager-dev1515 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   Why I want to work on this: This is a policy doc where the failure mode is silent and slow — someone testing against testnet pastes a real email, a real wallet mapping, or a production-shaped record into testnet metadata "just to see it work," and it stays there forever because testnet has weaker operational guarantees than production and nobody is deleting it. The doc needs to be unambiguous about what counts as real user data (people under-specify this and assume "it's just test data"), why testnet is the wrong place for it (lower operational security, no retention guarantee), and what to do instead (synthetic data, generated fixtures, obvious placeholders). The point is to give a reviewer and an integrator a single sentence they can cite when pushing back.

   Relevant experience:

   Policy writing for lower-trust environments — I've written and reviewed data-handling policies that explicitly scope "what this environment is for" versus "what it isn't," because the failure isn't people disagreeing with the policy — it's people assuming their case is the exception. I write the examples that close that gap: "this includes X, Y, Z; a hashed email is still PII; a test-shaped record containing a real wallet address is still real user data."

   PII classification for blockchain contexts — I understand the specific hazard here: on-chain data is immutable and public, so the usual "we can delete it later" mitigation doesn't apply. A testnet account with a real user's address or metadata is effectively a permanent disclosure, regardless of what testnet's lifecycle promises.

   Paired runbook/policy docs — I've kept policy docs and their operational runbooks consistent (like the pairing on #848/#844), so a person reading the runbook for "how to clean up testnet data" lands on the policy that explains why the cleanup is necessary in the first place.

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @Manager-dev1515 to this issue.
5. chinweobtagaz commented on Oct 17, 2026

   

   chinweobtagaz

   on Oct 17, 2026 – with Drips Wave

   Contributor

   More actions

   @chinweobtagaz has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   hi maintainer, can i work on this issue ??

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @chinweobtagaz to this issue.
6. phertyameen

   assigned

   chinweobtagaz

   on Oct 17, 2026
7. drips-wave commented on Oct 17, 2026

   

   drips-waveBot

   on Oct 17, 2026 – with Drips Wave

   More actions

   Congratulations, @chinweobtagaz! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

   🧑‍💻 @chinweobtagaz: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

   Warning

   When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

   🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

   🌊 Happy Wave 🌊
8. grantfox-oss commented on Oct 17, 2026

   

   grantfox-ossBot

   on Oct 17, 2026 – with GrantFox OSS

   More actions

   🎉 This issue has been marked as completed on GrantFox!

   @chinweobtagaz's PR #940 was approved and merged by @phertyameen.

   🏆 @chinweobtagaz: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (424 total points). Track your full progress on GrantFox.

   👏 Great work, @chinweobtagaz! Keep contributing to bridgelet-org.
9. phertyameen

   closed this as completedin #940on Oct 17, 2026
10. drips-wave commented on Oct 17, 2026

    

    drips-waveBot

    on Oct 17, 2026 – with Drips Wave

    More actions

    This issue has been completed by @chinweobtagaz as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @chinweobtagaz: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.