Everything I could decide myself is decided. What's left needs
you. Each one has a recommendation from Fable — if you agree, pick it and
press Done. "I'm not sure" is a real answer and becomes work for me.
You don't need to open the session — pressing Done sends your answer back and it picks up.
1Confirmed PII exposure on propflow-stage: 8 un-anonymized production rows (4 real tenant phone numbers, 2 real gmail addresses, 1 person row, 1 prospect-email row) readable on the shared non-prod table since 2026-05-18. Remediation sequencing, and is it reportable?
In plain terms. Some real tenant contact details have been sitting in our test environment since May — four phone numbers and two email addresses belonging to actual Camellia people, plus two related records. They should have been scrambled into fake ones on the way in, and weren't. Our own checker has been flagging this the whole time and nobody saw it. Nothing outside the company can reach it, but more people can see the test system than can see the live one. I can delete them today, which stops it immediately and loses nothing, since the real records still live in AppFolio. The proper repair afterwards is a job the pipeline owner runs. What I can't decide for you is whether this counts as an incident you'd want to write up.
Fable recommends: Delete them today, then have the pipeline owner do the proper repair Stopping it does not need to wait for the permanent fix, and deleting costs nothing: AppFolio and the live table are still the record, and I have already written down exactly what was there, so we keep the evidence without keeping the exposure. It has been three months. I am deliberately NOT choosing between deleting quietly and writing it up, because whether this is reportable is your call about the company, not an engineering question. One warning for whoever does the permanent repair: do NOT make the cleanup tool treat these rows as deletable by removing its provenance exemption. That would make it treat the entire mirror as deletable and wipe about 129,000 rows. The exemption is correct. Tried first, unsuccessfully: No valid verdict on my side: my fable-decide run errored (receipt fd36889fe) and correctly refused to report from a single surviving pass. The other operator holds a valid receipt f1ef49a6f which settled only the FACTUAL half (the leak is real, matched against prod), not the remediation sequencing I am asking about.