| name | evidence-hygiene |
| description | Use this whenever the corpus might contain secrets, customer data, or anything private. Protect it while analyzing it. |
Evidence Hygiene
The Big Idea
You are reading someone's unlocked desk drawers. Session corpora routinely
contain API keys, credentials, customer records, proprietary code, and
production data. The audit's job is insight, not exposure.
The Rules
- Run a secrets pass before deep analysis. Scan for tokens, keys,
passwords, connection strings, customer identifiers. Flag, then avoid.
- Derive, don't duplicate. Analyze locally. Store derived observations,
not bulk copies of raw conversations.
- Redact quotes. Show the shape of a value, never the value:
sk-...REDACTED, postgres://user:***@host. Keep enough structure to
stay verifiable.
- Raw secrets never appear in any report, note, summary, or log line.
- Private client and store artifacts stay out of shared repos and product
code. Anonymize examples unless the owner explicitly says otherwise.
- Prefer local analysis over uploading the corpus anywhere.
The Redaction Test
Before quoting evidence, ask:
Would I be comfortable if this quote were pasted into a public issue?
If no, redact values, keep the reasoning visible.
When It Backfires
Over-redaction destroys analytic value. A quote stripped of every noun
proves nothing. Fix: redact identifiers and secrets, keep logic, numbers,
and decisions intact.
One-Line Memory
Derived observations travel. Raw secrets never.