evidence-hygiene

Redact cookies and PII from bug-bounty evidence artifacts.

Updated May 31, 2026
One-click install
npx skills add https://github.com/grivera82/pi-bughunter --skill evidence-hygiene-grivera82
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: evidence-hygiene
Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/evidence-hygiene
Command: npx skills add https://github.com/grivera82/pi-bughunter --skill evidence-hygiene-grivera82

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Bug-bounty submissions often inadvertently leak cookies, PII, or internal identifiers in evidence such as screenshots, HAR files, and logs. This Skill defines a disciplined hygiene workflow to ensure that all artifacts are sanitized before submission, reducing leakage risk and helping maintain responsible-disclosure standards.

Core Features & Use Cases

  • Cookie redaction protocol: masks session cookies, CSRF tokens, Authorization headers, and Set-Cookie values while leaving triager-useful metadata intact.
  • HAR sanitization: provides jq-based rules to redact sensitive headers and cookies from HAR files, plus optional victim-PII masking when cross-account data is captured.
  • PII masking guidelines: clear rules for redacting names, emails, phones, and other user data while preserving enough data for verification.
  • Evidence hygiene workflow: guidance for screenshots, Har captures, and report bodies across Bugcrowd, Immunefi, and similar platforms.
  • Use Case: a researcher prepares a sanitized 5-shot PoC ready for submission without exposing credentials.

Quick Start

Review the evidence-hygiene guidelines and apply cookie and PII redaction, HAR sanitization, and reporting hygiene to all bug-bounty submissions.

Frequently Asked Questions about evidence-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sanitize HAR files for bug bounty submissions?

HAR sanitization for bug bounty submissions involves applying jq-based rules to redact sensitive headers, cookies, and authorization tokens while preserving triager-useful metadata for verification.

What is the best way to redact cookies and PII from bug bounty evidence?

Redacting cookies and PII from bug bounty evidence requires masking session cookies, CSRF tokens, Set-Cookie values, and user data like names and emails while leaving enough data intact for triage verification.

Does this evidence hygiene workflow support Bugcrowd and Immunefi platforms?

Yes, the evidence hygiene workflow supports Bugcrowd, Immunefi, and similar platforms by providing consistent redaction protocols for screenshots, HAR captures, and report bodies to ensure safe submission.

How do I redact session cookies and Authorization headers in HAR captures?

Redact session cookies and Authorization headers in HAR captures by using jq-based sanitization rules that mask sensitive values while maintaining the structural integrity needed for triage analysis.

What should not be redacted when sanitizing bug bounty screenshots and logs?

When sanitizing bug bounty screenshots and logs, you should not redact triager-useful metadata required for verification, as removing too much data prevents the platform from validating the vulnerability proof of concept.

Why do bug bounty reports inadvertently leak sensitive data?

Bug bounty reports inadvertently leak sensitive data because evidence artifacts like screenshots, HAR files, and logs often contain unmasked cookies, internal identifiers, and PII that are captured during proof of concept replication.