Redact a bug-report screenshot before you file it

Repro: open settings. Actual PNG: your .env in VS Code, a production URL, and a session cookie in Application tab.

Bug reports reward completeness. Completeness is how a local path with your username, a bearer token in a query, and a customer email in the fixture ride along with the stack trace. GitHub issues are public by default more often than you remember. Internal Jira still gets exported and pasted into a vendor portal. Assume crawlers.

Bar every secret that is not the bug. Keep the error, the unexpected layout, the console line that names the failing function. Then file the issue with the barred PNG. If a token still appeared, rotate it. “I think the bar covered it” is not a rotation policy.

The screenshot is not the repro steps

Write the steps in text. Use the image for what text cannot show: a clipped button, a wrong color, a race you only caught once. A full IDE publishes your workspace. DevTools Application publishes cookies. A terminal publishes hostnames, kube contexts, and sometimes a password you typed and then cursed about.

Crop to the window that exhibits the defect. If the URL bar is in frame, bar tokens, preview deployment hashes that map to private repos, and admin path segments. If the editor is in frame, bar.env, AWS keys, and any file named like a dump of production.

Cover

• Query tokens, API keys, and Authorization headers
• Local file paths with usernames and company share names
• Customer names, emails, addresses, and ID numbers in “dummy” rows
• Salaries, invoice totals tied to a person, payroll CSVs
• Session cookies, JWT fragments, and refresh tokens in storage
• Internal hostnames, VPN IPs, and staging basic-auth

Dummy data that came from a prod snapshot is still someone else’s address and national ID. Black-bar the columns. Do not rely on a mosaic over a table of digits. Tables are exactly the case where blur fails after JPEG.

Public trackers versus private ones

On a public GitHub issue, treat the screenshot as a press release: no customer PII, no home directories, no secrets. On a private tracker, still bar anything you would not put in a partner slide deck. Vendors read tickets. Attachments sync to Slack and to acquisition dumps.

If the bug is “this user cannot check out,” you do not need their street in the PNG. Put the user id in the ticket field. Show the broken button. If legal later needs the raw capture, store it in the system that already holds the customer record, not in the issue attachment that syncs to Slack.

Should I redact before or after I reproduce locally?

Reproduce first on a throwaway account or seed data. Capture second. Redact third. Attach fourth. If you captured first on production because that is the only place it happens, redact before the file leaves your disk. Do not drop the raw PNG on the desktop “for later” in a shared Dropbox.

FAQ: the secret was already in the repo, does the screenshot matter?

Yes. A screenshot is a second distribution channel with a preview thumbnail in Slack, email, and mobile notifications. People who never clone the repo will still see the PNG. Rotate the credential either way. The screenshot is how the intern on their phone learns the key exists.

FAQ: can I blur the terminal and keep the stack trace?

You can crop to the stack trace and bar the prompt that contains the user@host. Do not blur a wall of hex or a cookie string. Opaque bars on the secret lines, readable text on the frames you need. If the stack trace itself interpolates an email or a card number, bar that substring; the frame names can stay.

FAQ: what if CI posted the screenshot for me?

Playwright and Cypress artifacts are full-page by default. Mask or shoot a locator. If a failed job already uploaded a raw capture to a public Actions log, treat it as a leak: rotate, delete the artifact if you can, and fix the test. Do not re-upload a blurry copy of the same cookies.

Tokens in chrome are a specialist case: URL bar keys. Support tickets have the same customer-data problem as bugs; the support screenshot checklist maps cleanly onto fixtures. For the next failing settings page, paint the bars locally and attach that PNG, not the IDE.