Redact Sensitive Content
Overview
Inspect Markdown files for sensitive content, replace unnecessary identifiers with safe stand-ins, and verify that obvious leaks are gone before the content leaves a private workspace.
Use the scanner as a fast guardrail, then patch the file manually for context-aware redaction. Do not trust regex-only checks as a complete safety guarantee.
Quick Start
- Read
references/content-review-checklist.md.
- Run
scripts/scan_sensitive_content.py on the target file or directory.
- Patch each finding to remove or generalize private details.
- Re-run the scanner until the remaining hits are intentional and safe.
- If the content is going public, do one final human read focused on screenshots, examples, code blocks, stack traces, and links.
Workflow
1. Decide what needs protection
- Always review:
- personal email addresses, phone numbers, IDs, real names, usernames
- internal IPs, internal domains, hostnames, cluster names, namespace names
- filesystem paths with real usernames or machine structure
- access tokens, API keys, JWTs, cookies, passwords, signed URLs
- customer names, contract numbers, ticket links, screenshots with dashboards or internal links
- Preserve only the technical lesson. Remove everything that is not required for public understanding.
2. Run the scanner
From the repo root or any workspace:
python ~/.codex/skills/redact-sensitive-content/scripts/scan_sensitive_content.py path/to/file.md
python ~/.codex/skills/redact-sensitive-content/scripts/scan_sensitive_content.py docs
The script exits with:
0 when it finds nothing obvious2 when it finds potential leaks
Use the findings as review targets, not as an excuse to redact blindly.
3. Redact with context
- Preferred replacements:
someone@example.com138****567810.x.x.xinternal.example.com/path/to/project某客户工程师 A***REDACTED***
- For screenshots, crop or recreate them instead of publishing raw internal captures.
- For incident writeups, keep chronology and root cause, but remove customer identifiers and operational handles.
4. Re-scan and finish
- Run the scanner again after editing.
- If findings remain, decide one by one whether they are safe examples or still require redaction.
- Call out any residual risk explicitly if a realistic example must stay for technical accuracy.
Resources
references/content-review-checklist.md
- Review rules and replacement patterns for public-safe content.
scripts/scan_sensitive_content.py
- Detect common sensitive strings in Markdown files.
1---2name: redact-sensitive-content3description: Review and sanitize Markdown content before it is published, shared externally, committed to a public repo, pasted into social posts, or included in blog articles and incident writeups. Use when the user asks to 脱敏, 内容审查, 检查敏感信息, 清理隐私数据, sanitize Markdown, or verify that text files do not expose personal information, internal infrastructure, secrets, or business-sensitive details.4---56# Redact Sensitive Content78## Overview910Inspect Markdown files for sensitive content, replace unnecessary identifiers with safe stand-ins, and verify that obvious leaks are gone before the content leaves a private workspace.1112Use the scanner as a fast guardrail, then patch the file manually for context-aware redaction. Do not trust regex-only checks as a complete safety guarantee.1314## Quick Start15161. Read `references/content-review-checklist.md`.172. Run `scripts/scan_sensitive_content.py` on the target file or directory.183. Patch each finding to remove or generalize private details.194. Re-run the scanner until the remaining hits are intentional and safe.205. If the content is going public, do one final human read focused on screenshots, examples, code blocks, stack traces, and links.2122## Workflow2324### 1. Decide what needs protection2526- Always review:27 - personal email addresses, phone numbers, IDs, real names, usernames28 - internal IPs, internal domains, hostnames, cluster names, namespace names29 - filesystem paths with real usernames or machine structure30 - access tokens, API keys, JWTs, cookies, passwords, signed URLs31 - customer names, contract numbers, ticket links, screenshots with dashboards or internal links32- Preserve only the technical lesson. Remove everything that is not required for public understanding.3334### 2. Run the scanner3536From the repo root or any workspace:3738```bash39python ~/.codex/skills/redact-sensitive-content/scripts/scan_sensitive_content.py path/to/file.md40python ~/.codex/skills/redact-sensitive-content/scripts/scan_sensitive_content.py docs41```4243The script exits with:4445- `0` when it finds nothing obvious46- `2` when it finds potential leaks4748Use the findings as review targets, not as an excuse to redact blindly.4950### 3. Redact with context5152- Preferred replacements:53 - `someone@example.com`54 - `138****5678`55 - `10.x.x.x`56 - `internal.example.com`57 - `/path/to/project`58 - `某客户`59 - `工程师 A`60 - `***REDACTED***`61- For screenshots, crop or recreate them instead of publishing raw internal captures.62- For incident writeups, keep chronology and root cause, but remove customer identifiers and operational handles.6364### 4. Re-scan and finish6566- Run the scanner again after editing.67- If findings remain, decide one by one whether they are safe examples or still require redaction.68- Call out any residual risk explicitly if a realistic example must stay for technical accuracy.6970## Resources7172- `references/content-review-checklist.md`73 - Review rules and replacement patterns for public-safe content.74- `scripts/scan_sensitive_content.py`75 - Detect common sensitive strings in Markdown files.
biblosaggins