What problem does it solve?
This skill prevents accidental leakage of session cookies, Authorization tokens, and other users’ PII in screenshots and HAR attachments, which can invalidate bug-bounty submissions and create real privacy risk.
Core Features & Use Cases
- Cookie redaction discipline: Identifies what to mask (session cookies, CSRF-bound tokens, Authorization, Cookie/Set-Cookie values) and recommends practical capture techniques (avoid capturing cookies, hide Burp request bodies, black-bar overlays when necessary).
- PII black-bar protocol: Distinguishes between attacker-session data you can keep and other-user PII you must mask (names, emails, phones, faces/photos, sensitive IDs), while preserving triager-valuable structure (field presence and schema).
- HAR sanitization via jq: Provides a concrete sanitization approach to strip sensitive headers/cookies and suggests additional response-body redaction when cross-account data is present.
- Evidence readiness hygiene: Enforces before/after checklists (panel visibility, console screenshot practices, verification by searching for cookie substrings) and post-submission rotation guidance to render captured secrets dead.
Quick Start
Use evidence-hygiene to prepare a clean set of Bugcrowd-style attachments by redacting session cookies, black-barring other-user PII, and sanitizing any exported HAR file before you upload your PoC.
