Checklist
- Logs — strip tokens, session IDs, emails, IP addresses, and customer data.
- Configs — replace API keys, passwords, and connection strings with placeholders (e.g.
YOUR_API_KEY). - Hostnames — replace internal hosts and domains with
example.com. - Screenshots — crop or blur address bars, tokens, and personal data.
If a secret was ever exposed, rotate it — removing it from the post is not enough.