Redact security evidence without losing its meaning
Remove credentials and personal data from a security report while preserving the ownership, sequence, and behavior needed to verify the finding.
Redaction should remove sensitive values while preserving the relationship that proves the finding. If every identifier becomes the same black box, engineering may no longer be able to tell which user accessed which tenant's record. Use consistent labels and retain only the fields needed to explain the behavior.
Keep the original evidence only when the engagement permits it, in the agreed restricted location. Produce a separate redacted copy for wider review. Do not alter the original and later present the edited record as an untouched capture.
What should you replace or remove?
| Evidence element | Safer presentation |
|---|---|
| Session token or API key | Remove the value completely |
| Customer email | Replace with a stable synthetic identity label |
| Tenant identifier | Use Tenant A or Tenant B consistently |
| Private document contents | Keep only a harmless marker needed to show ownership |
| Internal hostname | Use an approved alias when the exact host is unnecessary |
| Timestamp | Retain useful sequencing without unrelated activity |
| Request identifier | Keep only if it does not expose sensitive routing information |
The OWASP logging guidance identifies sensitive data that should not enter routine logs. Reports and attachments need an equivalent review. Redaction is not complete because the main paragraph looks clean.
Where do secrets remain hidden?
Check HTTP headers, query strings, screenshots, downloaded archives, error stacks, and copied browser storage. Inspect document properties and image metadata when relevant. A screen recording can reveal a value for one frame even when the final screenshot is safe.
For a PDF, use a real redaction method rather than drawing a rectangle over selectable text. For structured evidence, remove the field or replace its value before export. Reopen the deliverable and search for known sensitive values to verify the result.
Do not paste private evidence into an unapproved service to redact it. The redaction workflow itself is part of the data-handling agreement.
How do you keep the report verifiable?
Add a short legend that explains the substitutions. For example, Tenant A and Tenant B represent separate synthetic organizations, while Record B belongs only to Tenant B. Keep those labels consistent across requests, responses, and diagrams.
State what was removed and why, without repeating the removed value. If a necessary detail cannot be shared with the intended reader, explain the limit and arrange a narrower review through the approved channel.
Discuss a scoped review with Sourced before transferring sensitive material. The first inquiry only needs the system type and the question you want answered.
Know what you will get from a review
Explore an illustrative finding with evidence, a proposed fix and retest criteria. Discuss your systems, review questions and deadline when you are ready.
Sources
- OWASP Logging Cheat SheetAccessed
- OWASP Web Security Testing Guide: ReportingAccessed