EVIDENCE HYGIENE — PoC Capture & Redaction Discipline

Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.

The core principle: Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.

1. Sensitive Data Categories of Sensitive Data

Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.

Category	Examples	Treatment
Your-account secrets	Session cookies, OAuth tokens, refresh tokens, API keys	Always redact. Even in private bug-bounty platform attachments. Your account, your session — protect it.
Other users' PII	Real names, emails, phone numbers, addresses, profile photos, account IDs	Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display.
Triager-useful metadata	Trace IDs (`x-datadog-trace-id`), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes	Review and minimize — selected nonsecret values help the triager correlate to logs and reproduce.
Test-account passwords (limited use)	Throwaway passwords on a test account (e.g., `Testing@5678`)	Redact passwords before sharing, including throwaway accounts. Rotate/revoke any exposed value; do not rely on later rotation to justify disclosure.