EVIDENCE HYGIENE — PoC Capture & Redaction Discipline

Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.

The core principle: Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.

1. Two Categories of Sensitive Data

Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.

2. Cookie Redaction Protocol

2.1 What must be masked

The session cookie value is the highest-value secret in any PoC. Mask:

• The session cookie (authn, session, sid, __Secure-id, etc. — name varies per target)
• csrf-token if it's bound to your session
• Authorization headers (Bearer tokens, JWT)
• Cookie request header values for any session-bearing cookie
• Set-Cookie response header values for any session-bearing cookie

2.2 What's safe to leave visible

• Cloudflare cookies (__cf_bm, _cfuvid) — these are bot-management, not session-bearing
• Analytics cookies (ajs_anonymous_id, _ga)
• Trace correlation IDs (x-datadog-trace-id, x-request-id)
• Server / framework headers (Server: cloudflare, X-Frame-Options)
• Your test account email/UID (per Bugcrowdninja alias section in bugcrowd-reporting)

2.3 Redaction methods (ranked by practicality)

Method A — Don't capture the cookies in the first place (preferred when possible)

• For DevTools Console PoCs: use credentials: 'include' so the browser sends cookies automatically. Console output won't echo the cookie. Screenshot the Console output, never the Network tab Headers panel.
• For Burp Repeater PoCs: drag the bottom request/response panel divider DOWN to hide the request body before screenshotting. Capture only the Results table for Intruder runs.

Method B — Black-bar in image editor (when capture inevitably includes cookies)

• macOS: Open screenshot in Preview → Tools → Annotate → Rectangle → set fill color to black → drag rectangle over the cookie value → save
• Windows: Use Snip & Sketch's annotation tools or any image editor (Paint.NET, etc.)
• Burp itself: in Burp's Proxy → Match and Replace, you can pre-emptively redact cookie values to placeholder strings before screenshotting

Method C — Find/replace in raw text (for HAR files, terminal transcripts)

• See §4 for the jq commands

2.4 Pre-screenshot checklist

Before clicking Capture:

[ ] Network tab Headers panel is collapsed or out of frame
[ ] Burp's Request panel is hidden behind the divider drag
[ ] No "Copy as cURL" output is visible on screen
[ ] DevTools Application → Storage → Cookies tab is closed
[ ] Browser URL bar doesn't show a session token in query string (rare but possible)

After capturing:

[ ] Open the screenshot at full resolution before saving
[ ] Search for the session cookie name substring in any visible text — if present, redact
[ ] Search for the literal first 6 chars of your cookie value — if present, redact
[ ] Compare to the previous PoC screenshot in the same engagement — same redaction discipline

3. PII Black-Bar Protocol

…