Too many secrets

No switches without a light.

This week we audited our own environment configuration and found ten features we forgot we had.

Not half-built features. Not prototypes. Shipped, tested capabilities: cross-session memory recall, overnight knowledge consolidation, a knowledge implant that feeds an agent's prompts from your second brain, connectors for Notion and Google Drive, the honesty guards we wrote a whole essay about. All of them dark, each behind an environment variable that no compose file referenced, no document named, and no screen displayed.

The founder of this company learned some of these existed by reading an audit table. He commissioned them.

The audit's full numbers are worth stating plainly, because we suspect they are not unusual. Three hundred and fifty six environment variables across ten services. Roughly one hundred and fifty declared in deployment configuration; the rest reachable only by reading source. Thirty six of them are behaviour switches, not plumbing: they turn real product capabilities on and off.

Twenty four are things a user would genuinely want to control. Seventeen describe state a user deserves to see. Documented in our example configuration: almost none of them.

How this happens

Nobody decides to hide features. Each flag made sense the day it was written: ship dark, test in private, flip it when ready. The flip never comes, because flipping requires remembering, and the person who would remember has moved to the next stream. Multiply by two years of fast shipping and you get a product wearing a trench coat over half its wardrobe.

The cost is not hypothetical. A capability nobody can see does not exist for the customer evaluating you, does not exist for the colleague building on top of it, and eventually does not exist for the team that built it.

It cannot be sold, cannot be documented honestly, and cannot even be turned on with confidence, because dark switches accumulate untested interactions in the dark. We named this class of debt after the anagram at the heart of the film Sneakers: Setec Astronomy. Too many secrets.

The rule we wrote

So we made a law and put it in the repository where the linters live. No feature ships with only an environment flag. If it exists, four things are true:

1. Its state is visible in the dashboard, somewhere a user actually looks.
2. If it is user-relevant, it has a settings surface: a server-side setting that overrides the environment default. Environment files remain the bootstrap layer for operators, never the product.
3. It is documented: a real docs entry, and a line in the example configuration.
4. If it is sellable, it is sold: a page, an explainer, a link.

A feature merged with only an env flag is not done. That sentence is now part of our definition of done, and it applies retroactively: the audit produced a classification of every flag, and each one is being promoted into settings, surfaced as a status chip, or explicitly demoted to operator plumbing with documentation saying so.

The compounding part

Here is what surprised us, again. The audit was cheap: one afternoon of systematic reading. The findings were not subtle once listed. And the fixes are mostly small: a settings card, some status chips, honest documentation.

But the effect on the product is the same effect a good honesty guard has on an agent: the gap between what the system is and what the system appears to be closes, and everything downstream of that gap (sales claims, support answers, roadmaps, our own confidence) gets cheaper and truer at once.

We wrote last time that honest gaps get filled. The corollary turned out to be about surfaces rather than answers: honest surfaces get used. A capability behind glass is a demo. A capability with a switch, a status light and a page is a product.

If you run a platform of any age, we would gently bet you have your own Setec Astronomy drawer. The audit takes an afternoon. Grep for your environment reads, list every flag that changes behaviour, and ask of each one: can my user see this, set this, read about this?

The ones that fail all three are your missing features. You already paid to build them. Turning on the lights is the cheap part.

No secrets without a reason. No switches without a light.