What we keep private

Building in the open is easy to say and harder to mean. We're public by default, genuinely, not as a marketing pose. But "default" is not "always," and pretending otherwise would be its own kind of dishonesty. Here's the actual boundary: what stays private, and why each thing earns its spot on the list.

The default is open

Start here, because it's the part that's true almost all the time. Decisions, plans, docs, code, arguments, the handbook you're reading: public unless there's a specific reason otherwise. Public channels over DMs, comments over asides, the GitHub org over a conversation nobody else can see.

The reason isn't that we're incapable of keeping a secret. It's that openness compounds. Something written in the open is searchable, correctable, and useful to a person you haven't met yet who hits the same wall next month. Every private conversation is a small debt the next person pays.

What stays private

A short list, and it's meant to stay short:

• A person's own situation. Someone's health, family, finances, a hard stretch they're going through: that's theirs to share, at the volume they choose, if at all. It is never ours to broadcast on their behalf.
• Security fixes before they ship. When there's a live vulnerability, publishing the details before the patch is out just hands the exploit to whoever's paying attention. We fix quietly, ship, then tell the story afterward. Openness with a delay, not a permanent secret.
• Things customers trusted us with. Data, private details, anything shared with us in confidence because they had to in order to use the product. That trust isn't ours to spend on being transparent. It's the whole reason they can rely on us at all.
• Individual pay. Not the framework, the individual figures. How we decide pay is public and should be: the bands, the logic, the philosophy. What a specific named person earns is that person's private business, and putting it on blast helps nobody they'd thank you for.

Notice the shape. Two of these are private forever because they belong to someone else (a person's own life, a customer's trust). One is private only until it ships (security). One splits cleanly: the system is public, the individual number isn't.

Secrecy carries the burden of proof

One rule sits under the whole list, and it's the thing to remember if you forget everything else on this page: secrecy has to justify itself. Openness doesn't.

When something's public, that needs no defense; it's the default, and the burden's already met. When you want to keep something private, that's the move that owes an argument. Not a vague "this feels sensitive," but a real one: whose is it to share, who gets hurt if it's out, is this private forever or just private until a patch lands. If you can't answer that, it probably wants to be in the open.

That framing keeps the private list from growing the way private lists always want to grow. Every organization drifts toward keeping more quiet, because in any single moment silence is the low-effort, low-risk choice. Making secrecy carry the burden of proof is how we stop the drift. The list above is short because it has to keep earning its place, item by item, and anything that can't is already public.

None of this is a legal document, and it isn't the fine print on "built in the open." It's the same commitment, told completely enough to include its own exceptions. For how this plays out day to day, see how we communicate and how we work.