What problem does it solve? Bug-bounty evidence often leaks live session cookies, authorization tokens, or other users' PII when screenshots and HAR files are attached to submissions, creating security and responsible-disclosure risks. This Skill defines the redaction and sanitization discipline to apply before any evidence leaves your machine. ## Core Features & Use Cases - Cookie and Token Redaction Protocol: Specifies which headers and cookie values must be masked (session cookies, Authorization, CSRF tokens) versus what is safe to leave visible (trace IDs, Cloudflare cookies), with Preview black-bar, Burp panel-hiding, and DevTools workflows. - HAR Sanitization with jq: Provides a reusable jq filter that strips Cookie, Set-Cookie, and Authorization values from exported HAR files, plus verification grep commands to confirm nothing leaked. - PII Black-Bar Discipline: Defines what to mask in cross-account data (names, emails, phones, faces) versus what proves the bug (field names, response shapes, attacker UID), with a worked IDOR example. - Use Case: Before submitting a rate-limit finding, you capture a Burp Intruder Results table with the request panel hidden, sanitize the exported HAR with the jq filter, and follow the 5-step screenshot naming convention so the triager receives clean, leak-free evidence. ## Quick Start Before attaching any PoC screenshot or HAR to my bug-bounty report, review the evidence and tell me exactly what to redact and how.
