skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

evidence-hygiene

Redact cookies, PII, and tokens from bug-bounty PoC screenshots and HAR files.

Updated Sep 6, 2026
Search Tags:#redaction#bug bounty#burp suite#responsible disclosure#pii masking#har sanitization#poc evidence
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill evidence-hygiene-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: evidence-hygiene
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/evidence-hygiene
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill evidence-hygiene-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Bug-bounty submissions often leak live session cookies, authorization tokens, or other users' PII inside screenshots and HAR files, creating security risks and triage friction. This Skill enforces a redaction and sanitization discipline so evidence convinces triagers without exposing secrets. ## Core Features & Use Cases - Cookie and Token Redaction Protocol: Defines which headers and cookies to mask (session cookies, Authorization, CSRF tokens) versus what is safe to leave visible (trace IDs, Cloudflare cookies), with Preview black-bar, Burp panel-hiding, and DevTools workflows. - HAR Sanitization with jq: Provides a reusable jq filter that strips Cookie, Set-Cookie, and Authorization values from exported HAR files, plus verification grep commands before attaching. - PII Black-Bar Discipline: Specifies what to mask in cross-account data (names, emails, phones, faces) versus what proves the bug (field shapes, attacker UID, trace IDs), with worked IDOR examples. - Use Case: Before submitting a rate-limit finding, you capture a Burp Intruder Results table with the request panel hidden, sanitize the exported HAR with the jq filter, and follow the 5-screenshot capture order with numbered filenames for the report. ## Quick Start Review my PoC screenshots and HAR file for this bug-bounty submission and tell me exactly what to redact before I attach them.

Frequently Asked Questions about evidence-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sanitize a HAR file before attaching it to a bug report?▼

Use the provided jq filter to replace Cookie, Authorization, and X-CSRF-Token request headers plus Set-Cookie response headers with a REDACTED placeholder. Then verify with grep that no real cookie values remain before attaching the sanitized file.

What should I redact in a bug bounty PoC screenshot?▼

Always mask session cookie values, Bearer tokens, and CSRF tokens. When demonstrating cross-account bugs like IDOR, also black-bar victim names, emails, phone numbers, and faces while leaving field names, trace IDs, and your own test account UID visible.

How do I take a clean Burp Suite screenshot without leaking cookies?▼

In Repeater, drag the panel divider down to hide the request headers before capturing, or temporarily delete the Cookie header text. For Intruder rate-limit demos, capture only the Results table columns and exclude the request and response sub-panels.

Can I use Chrome DevTools Console for PoC demos without exposing cookies?▼

Yes. Use fetch with credentials set to include so the browser sends cookies automatically without them appearing in your code or output. Screenshot only the labeled console.log output, never the Network tab Headers panel.

What cookies are safe to leave visible in bug bounty evidence?▼

Non-session cookies like Cloudflare bot-management cookies (__cf_bm, _cfuvid) and analytics identifiers are safe to leave. Trace correlation IDs such as x-datadog-trace-id should stay visible because they help triagers correlate your evidence with server logs.

What should I do with test account credentials after submitting a report?▼

Log out and back in to rotate the session cookie, then change the password to a fresh value so any credentials visible in screenshots become dead. Keep unredacted artifacts stored privately in case the triager requests them.

Related Skills

Explore More Software Engineering Skills→
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
grivera82grivera82

evidence-hygiene

Redact cookies and PII from bug-bounty evidence artifacts.

Community
Advanced
narlyseorgnarlyseorg
6

exploit-development

Generate exploit payloads and orchestrate Metasploit workflows within scoped engagements.

Community
Advanced
ritual-foundationritual-foundation
62

ritual-dapp-secrets

Encrypt and manage secrets for Ritual dApps using ECIES.

Official
Advanced