What Cinderella scrubs before you sell
The scariest part of selling a repo isn't the price — it's the thought of a stranger opening your code and finding an API key, a customer email, or the .env you forgot was there. That fear keeps good projects sitting in the dark.
So before anything lists on Cinderella, it runs through an automated scrubber. Here's what it does.
It drops files that shouldn't leave your laptop
.envfiles and their variants- Private keys and certificates (
.pem,.key, keystores) - SSH keys, database dumps, and backups
These never make it into the copy a buyer receives.
It redacts secrets inside your code
The scrubber scans text files line by line for the patterns that matter — OpenAI/Anthropic keys, AWS access keys, Stripe live keys, GitHub tokens, JWTs, private-key blocks, and generic secret = "…" assignments — and replaces them with safe placeholders. The structure of your code stays; the live credentials don't.
It redacts personal data
Emails and other PII get the same treatment, so you're not accidentally shipping someone else's information along with your side project.
It flags what it can't safely clean
Some things need a human. When the scrubber finds something it can't confidently resolve, the listing is held for review instead of going live. Better a short delay than a leak.
What it doesn't do
The scrubber never touches your git history — it operates on a clean copy, so the bundle a buyer downloads is the scrubbed one. And it's a strong safety net, not a guarantee: you're still responsible for what you upload. Give your project a once-over before listing.
Every listing shows its scrub result right on the page — how many files were removed, how many secrets redacted — so buyers can see it was handled, and you can sell without holding your breath.