An install had a user diff all of their company's private key material and CC all employees or something.

Having a Herald rule which can reject diffs based on repository, filename and diff content before we write them anywhere could help avoid this.