Logs and sharing redaction
Inspect the complete delivery before sharing: text, screenshots, attachments, diagnostics, handoffs, and experience assets. Redacting one log does not sanitize the entire package.
Prepare shareable diagnostics
Use Copy diagnostics or Open log folder under Settings > Advanced > service details. Review a copy and preserve original evidence. Inspect screenshots for conversation text, account, address bar, and paths; inspect every archive filename and attachment.
Before: Authorization: Bearer <real token>
After: Authorization: Bearer [removed]
Retain: time, operation, HTTP status, stable error code, correlation ID.
Remove: secret values, private keys, customer content, unrelated identities and paths.
This illustrates formatting, not a request to submit a real secret. Search the edited copy for sensitive values and reopen attachments. Do not send a package whose text is clean but screenshots expose secrets. Check recipient and visibility. See troubleshooting for feedback entry points.
Inspect four locations
- Arguments, stack traces, headers, and connection settings.
- Documents, screenshots, filenames, paths, and customer source material.
- Gene, Capsule, Recipe, SKILL.md, and publication summaries.
- Handoff attachments, diagnostic archives, and issue descriptions.
Replace tokens, private keys, passwords, authorization codes, and personal data with placeholders. Preserve field names, stable error codes, and minimal reproduction structure. Do not use live secrets in examples.
Automatic processing boundaries
Desktop text redaction handles URL credentials and pattern-matched secrets. Pattern matching does not cover images, every office document, or all customer content. Truncation and hash fingerprints are not anonymization: the retained prefix remains source text.
Do not execute a command altered by redaction as proof of validation. Supply secrets through a protected environment and retain secret-free evidence instead.
Handle a discovered leak
Stop further sharing, revoke or rotate affected credentials, and inspect recipients and generated copies. Masking one UI field does not remove secrets from Git history, external issues, or downloaded attachments.