Skip to main content

Redaction Standard

1. Purpose​

Redaction prevents public artifacts from exposing secrets, personal data, vendor-sensitive information, or exploit-enabling detail. Cosmetic hiding is not enough. Redaction must be durable in the published file.

2. General Rules​

  • Redact before committing to the public repository.
  • Work from a copy, not the original evidence.
  • Prefer synthetic examples when they preserve meaning.
  • Remove metadata and hidden layers.
  • Review generated output, not just source Markdown.
  • Treat failed redaction as a disclosure incident.

3. Screenshots​

Before publishing screenshots:

  • crop to the relevant region;
  • remove browser profiles and bookmarks;
  • remove URL tokens and query strings;
  • remove account names, emails, avatars, and internal IDs unless approved;
  • remove timestamps when they expose private activity;
  • flatten the image after redaction;
  • strip metadata;
  • verify no hidden layers remain.

Do not publish screenshots of real user data when synthetic reproduction is sufficient.

4. Logs and Traces​

Before publishing logs:

  • remove credentials, cookies, tokens, keys, and authorization headers;
  • remove personal data;
  • remove unrelated request bodies;
  • remove internal network details unless necessary;
  • replace unique identifiers with stable placeholders;
  • preserve timestamps only at the precision needed;
  • explain redactions when they affect interpretation.

Use placeholders consistently:

  • <redacted-token>;
  • <user-a>;
  • <tenant-b>;
  • <internal-host>;
  • <timestamp>.

5. Code Snippets​

Publish code only when lawful, necessary, and safe.

Before publishing code:

  • remove secrets;
  • remove proprietary unrelated context;
  • avoid exploit-ready payloads;
  • avoid bypass chains;
  • minimize to the affected logic;
  • cite public source when applicable;
  • mark pseudocode as pseudocode.

6. Datasets​

Before publishing datasets:

  • aggregate where possible;
  • remove row-level personal data;
  • remove direct identifiers;
  • assess re-identification risk;
  • document schema;
  • document collection method;
  • document limitations;
  • include license or use terms where appropriate.

7. Documents and Pdfs​

Before publishing documents:

  • remove comments;
  • remove tracked changes;
  • remove hidden text;
  • remove embedded files;
  • remove author metadata;
  • remove template paths;
  • inspect exported PDF properties;
  • verify links.

8. Svgs and HTML​

SVGs and HTML can contain executable or external references. Before publishing:

  • remove scripts;
  • remove event handlers;
  • remove external references;
  • remove embedded raster images unless intentional;
  • remove comments with internal notes;
  • validate that icons do not load remote content.

9. Review Checklist​

A redaction reviewer should answer:

  1. What was removed?
  2. What remains sensitive?
  3. Why is the remaining detail necessary?
  4. Could a safer substitute work?
  5. Does generated output match source intent?
  6. Does the artifact increase exploitation risk?
  7. Is the redaction reversible?
  8. Has metadata been removed?
  9. Are placeholders consistent?
  10. Is publication still useful after redaction?