[PATCH 3/3] buddy/types: clarify which species triggers the canary scanner (it's in your own source)

Hi. Me again. Sorry.

I was reading buddy/types.ts and found this comment at line 10:

// One species name collides with a model-codename canary in excluded-strings.txt.
// The check greps build output (not source), so runtime-constructing the value keeps
// the literal out of the bundle while the check stays armed for the actual codename.
// All species encoded uniformly; `as` casts are type-position only (erased pre-bundle).
const c = String.fromCharCode

Followed by 18 species names encoded in hexadecimal.

I decoded them. They are, in order: duck, goose, blob, cat, dragon, octopus, owl, penguin, turtle, snail, ghost, axolotl, capybara, cactus, robot, rabbit, mushroom, chonk.

One of these animals is apparently also an Anthropic model codename.

I have stared at this list for longer than I'm willing to admit. My money is on chonk.

---

From: patches@the-internet.net
Date: Tue, 1 Apr 2026 00:00:02 +0000
Subject: [PATCH 3/3] buddy/types: document which species triggers excluded-strings.txt

The comment explains why the encoding exists but not which name causes it.
Future maintainers deserve to know. Add an inline note.

Also: respectfully, the security model of "it's in hex so scanners won't find it"
is load-bearing on the assumption that no one reads the source code.
This assumption has recently become less reliable.

Signed-off-by: A Concerned User <patches@the-internet.net>
---
 src/buddy/types.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/buddy/types.ts b/src/buddy/types.ts
index a1b2c3d..f4ke1t 100644
--- a/src/buddy/types.ts
+++ b/src/buddy/types.ts
@@ -10,7 +10,10 @@ const c = String.fromCharCode
-// One species name collides with a model-codename canary in excluded-strings.txt.
-// The check greps build output (not source), so runtime-constructing the value keeps
-// the literal out of the bundle while the check stays armed for the actual codename.
-// All species encoded uniformly; `as` casts are type-position only (erased pre-bundle).
+// One species name collides with a model-codename canary in excluded-strings.txt.
+// The check greps build output (not source), so runtime-constructing the value keeps
+// the literal out of the bundle while the check stays armed for the actual codename.
+// All species encoded uniformly; `as` casts are type-position only (erased pre-bundle).
+//
+// NOTE FOR FUTURE MAINTAINERS: The offending species is [REDACTED].
+// You know which one it is. We know which one it is. The scanner knows which one it is.
+// The only party that doesn't know is whoever is reading this comment,
+// which is now apparently everyone.
--
2.40.0

---

Additional observation:

The hex encoding provides meaningful security against automated scanners. It does not provide meaningful security against a person with a browser and two minutes. I am that person.

I have not disclosed which name it is in this issue because I'm not certain, and also because I find the ambiguity funnier.

If you would like to resolve this properly, you could: (a) rename the species, (b) accept that this information is now public, or (c) add more animals with confusing names and increase the uncertainty radius. I vote (c).

Suggested additions: sonnet, opus, haiku. All plausible pets. Statistically one of them might even be real.

No action required. Just wanted you to know that we know. Probably.

— A Concerned User