Agree on data handling before a security review
Map what a security reviewer receives, where it goes, who can see it, and when it is removed. Use a practical evidence-handling worksheet.
Agree on data handling before a reviewer receives source code, credentials, or evidence. The important question is not simply whether a transfer is encrypted. You also need to know who can access the material, whether another service processes it, how long copies remain, and how deletion is confirmed.
Use the worksheet below to identify the actual data path. It is a planning tool, not a statement of legal compliance. Have the appropriate owner approve the terms for your organization and the specific material involved.
What crosses each boundary?
| Material | Minimum needed | Handling decision |
|---|---|---|
| Source code | Approved snapshot and relevant configuration | Named storage location and readers |
| Test credentials | Dedicated, restricted accounts | Separate secret channel and expiry |
| Request evidence | Synthetic identifiers and necessary fields | Redaction before report distribution |
| Logs | Relevant time range and event fields | Exclude tokens and unrelated customer records |
| Draft report | Evidence and remediation details | Approved recipients and access review |
| Model input | Only separately approved minimized excerpts | Provider, purpose, retention, and approval |
Do not assume that approving one tool approves all its integrations. A reviewer who uses a hosted model, transcription system, or shared notebook introduces another processing path. Discuss that path before private material enters it.
How much evidence is enough?
Capture what establishes the behavior and its impact. For a synthetic cross-tenant read, the test record's label and ownership can establish the boundary without retaining a customer's document. If a test unexpectedly returns sensitive information, stop at the minimum evidence needed and use the agreed escalation procedure.
The OWASP logging guidance describes information that should be excluded from logs. Apply the same care to screenshots, HTTP archives, and copied terminal output. A redacted report does not help if its attachment contains the original token.
What happens after delivery?
Name an owner for cleanup. Record which accounts are disabled, which credentials are revoked, which artifacts are deleted, and which agreed records must remain. A deleted local folder does not establish deletion from backups, shared drives, or external services.
Keep deletion claims specific. “Review archive removed from the named workspace” is supportable when verified. “All copies everywhere are gone” needs much broader evidence.
Before starting a Sourced review, discuss the material you expect to share. Do not send it in the first inquiry. Scope and data handling should be agreed before the transfer, including any model-assisted processing.
Know what you will get from a review
Explore an illustrative finding with evidence, a proposed fix and retest criteria. Discuss your systems, review questions and deadline when you are ready.
Sources
- OWASP Logging Cheat SheetAccessed
- OWASP Web Security Testing Guide: ReportingAccessed