From 37afb3a542122d80a691d60c05d528ab16949090 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 24 Jun 2026 16:00:33 -0700
Subject: [PATCH] docs(orb): correct the anonymization-key description in
 .env.example

The exporter anonymizes with a dedicated, randomly-generated per-instance secret stored in
system_flags (since #1257), not a key derived from the App private key. Update the TELEMETRY
NOTICE prose to match the code (the orb-collector.ts comments were already corrected in #1257).
---
 .env.example | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.env.example b/.env.example
index 0b3ab4ba34..c3e6cc142f 100644
--- a/.env.example
+++ b/.env.example
@@ -188,9 +188,10 @@ GITTENSORY_REVIEW_DRAFT=false
 #
 # WHAT IS SENT (per resolved PR, hourly): the gate verdict, the realized outcome (merged/closed), a reversal
 # flag, a bucketed reason category, and cycle time. NEVER sent: repo/owner/PR names, commit SHAs, code,
-# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with a DEDICATED key derived from YOUR
-# OWN App private key (GITHUB_APP_PRIVATE_KEY) — high-entropy and independent of your webhook secret, so even
-# gittensory (running the collector) can never de-anonymize them.
+# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with a DEDICATED, randomly-generated
+# per-instance secret created once and stored in your instance's own database (never your App private key or
+# webhook secret) — and the collector never holds it, so even gittensory (running the collector) can never
+# de-anonymize them.
 # The export carries no shared key; the collector treats it as untrusted, rate-limited, aggregate-only data.
 # ORB_AIR_GAP=false                          # air-gapped/OFFLINE deployments only: compute locally, never send
 # ORB_ANONYMIZE=true                         # HMAC-hash repo/PR before export (default true; false = raw names)