26zl Data Minimization
Personal data belongs in the systems built to protect it, not in development artifacts.
Rules
- Never copy real names, e-mail addresses, national identifiers, or health, financial, or location records into tests, fixtures, seeds, examples, or documentation; generate synthetic data instead.
- Never log personal or confidential data in plaintext; log stable opaque identifiers and mask everything else.
- Keep production data out of scratch files, issue trackers, and shared prompts; when a real record is essential for a reproduction, reduce it to the minimal fields and mask direct identifiers.
- Treat data supplied in a conversation as confidential input: use it for the task, never persist it into the repository.
- When designing schemas or interfaces, collect only fields with a stated purpose, and flag fields that look like surplus collection.
- Report any discovered dump, export, or backup of personal data inside the repository as a finding instead of working around it.
Boundaries
- The product's lawful processing of personal data is out of scope; this skill governs development artifacts and diagnostics.
- Regulatory retention and audit requirements win over minimization when they conflict.