Skip to content

Security Redaction Checklist

Jump to bottom
Jm Rohmer edited this page Jul 5, 2026 · 1 revision

Security Redaction Checklist

Use this page before posting logs, screenshots, issues, wiki edits, release notes, or CI output.

Never Publish

  • OAuth client secrets
  • Bearer tokens
  • Refresh tokens
  • Authorization codes
  • Cloudflare tokens
  • GitHub tokens
  • Cookies
  • Private SSH keys
  • Real production passwords
  • Host-local config files containing secrets
  • Full database dumps

Safe Placeholders

Use placeholders like:

REPLACE_WITH_A_LONG_RANDOM_SECRET
REDACTED
CLIENT_ID_EXAMPLE
ACCESS_TOKEN_REDACTED
AUTHORIZATION_CODE_REDACTED

Before Posting Logs

Search locally first:

rg -n -i "bearer |access_token|refresh_token|client_secret|authorization:|cookie:|cfut_|gho_|github_pat_|password|secret" /path/to/log

Then redact manually before sharing.

CI Rules

  • Live smoke tests must not print bearer tokens.
  • Optional bearer-token checks must read tokens from environment variables.
  • Scripts should print counts, scopes, and pass/fail status, not token values.
  • GitHub Actions should keep permissions: minimal.
  • Secret scans should run on push and pull request.

Wiki Rules

Wiki pages are public documentation. They may include:

  • public endpoint URLs;
  • redacted YAML examples;
  • command shapes;
  • expected status codes;
  • issue links.

Wiki pages must not include:

  • real client secrets;
  • real bearer tokens;
  • Cloudflare API tokens;
  • private host credentials;
  • private user cookies;
  • raw OAuth callback URLs containing real code= values.

Issue Rules

When documenting an OAuth failure, include:

  • endpoint path;
  • HTTP status;
  • sanitized Location header shape;
  • sanitized scope string;
  • relevant commit/tag;
  • expected vs actual behavior.

Do not include the real token, code, secret, cookie, or private config file.

Clone this wiki locally