A bug report needs the behavior, not a real user’s identity. Use a test account or invented values to reproduce the steps. Remove email addresses, tokens, session cookies, private document contents, and internal URLs from logs and screenshots. Preserve the error message, timing, request shape, and relevant environment details when safe.
If a sensitive field is essential to the failure, describe its format, length, or validation boundary instead of its literal value. Inspect browser address bars, developer-tools headers, and image metadata before publishing. If a secret has already been posted, treat it as compromised and rotate it. Explicitly mark any substitutions so readers can tell what was changed.
Akousa