@delroth
It sounds like it might make sense to deny access to testdata until the build is don (i.e.in nix terms, until the normal output is fully written out), because it's easiest to hide random cruft there.
Is this something that might be semi practical to do in nixos?