Turn a private project into a clean shareable package

When to use

The user wants to share one of their own projects (bot, script, tool) with someone else, and every piece of private data must be removed: API keys, wallet private keys, real addresses, trading/usage history, logs, env files, per-profile data.

Procedure

1. New clean working dir /tmp/<project>-share/ — never work in the project's original location (needless contamination risk).
2. Copy code only — cp the source files one by one (.py, .ts, .sh needed to run). Do NOT cp -r the whole folder.
3. .env.example — copy the real .env with placeholders: every field empty, with comments on where to get the key (free API signup URLs). Never ship the real one.
4. requirements.txt / package.json — only the minimal dependencies needed to run. Comment out optional packages (e.g. live-mode-only).
5. README.md — three blocks minimum:
   • Strategy / what it does (include the underlying logic so the recipient understands why it works, not just a black box).
   • Install + run (recommend a safe/paper-mode default).
   • Pitfalls / critical notes (the knowledge you earned through mistakes — otherwise the recipient will make exactly the same ones).
6. AUDIT — mandatory before packaging. grep the clean dir for:
   • Private-key patterns: 0x[a-fA-F0-9]{40,}|PRIVATE_KEY.*=.*\S
   • Real API keys: API_KEY.*=.*[A-Za-z0-9]{10,}
   • Concrete wallet addresses or user identifiers (know your own list of personal strings: emails, names, known wallet prefixes).
   • Result: every match must be an os.getenv / comment / code reference, never a hardcoded value.
7. Package cd /tmp && zip -r <project>-share.zip <project>-share (or push to a fresh git repo).
8. Deliver with an accompanying note that lists: what is included, the audit result (what it does NOT contain — more important than what it does), and the size.

Pitfalls

• cp -r of the whole folder always fails — it drags in __pycache__, venv, node_modules, logs, history files, backups, and other projects living in the same folder (many tools share one parent dir). Copy file by file.
• Audit BEFORE packaging — once it ships, it can't be un-shared. Secrets get cached and indexed even if you delete later.
• The README is the most valuable part — code alone is 30 minutes of reverse engineering; with a good strategy explanation the recipient gets real knowledge.
• Safe-mode default in the shared version (AUTO_TRADE=False or an equivalent flag). Leave the switch to live as a deliberate action by the recipient.
• Don't include internal-infrastructure integration (dashboard endpoints, routes, app loaders). The recipient doesn't have your environment.

Verification

• The audit grep runs clean (only variable references, no hardcoded secrets).
• The package listing contains only the files meant to be shared.
• The package size is proportional (10–100 KB for a small tool; MBs are suspicious — you probably dragged in a vendor dir).
• The accompanying note explicitly states what is NOT included.