It was a simple performance bug (think N+1 query type) that was trivial to implement and trivial to be confident about its behavior vs the pathological implementation, and I used the normal channels for shipping it, it passed QA.

The only "clandestine" part is that I added the split test, and did some work outside of the set of features that was scheduled.

We had no policies around SLA, developing off-site, security or restricting sensitive information (think potential FERPA/HIPPA violation) which are yet other "non-features" that I tried to get them to adopt.

I implemented this entirely above-board, with more precautions and consideration than were taken by other developers on that team for the day-to-day.