evidence-hygiene

To sanitize a HAR file for bug bounty evidence, use jq-based scrubbing to strip sensitive headers and cookies, then run verification checks to ensure no session tokens or PII remain. This prevents leaking authorization data in your report attachments.

When capturing Burp Suite screenshots for vulnerability reports, redact session cookies, authorization tokens, and other users' PII using a black-bar protocol. Leave JSON keys, field shapes, and attacker session identifiers visible so triagers can verify the bug structure.

To prevent session cookie leaks in DevTools captures for IDOR reports, apply explicit masking rules to authorization headers and cookies before exporting. Maintain a disciplined capture order and verify that correlation IDs left visible cannot compromise active sessions.

Yes, you can leave correlation IDs visible when redacting PII in web security findings. Mask names, emails, phone numbers, and government IDs, but keep JSON field shapes and correlation IDs intact so triagers can verify the vulnerability without exposing victim data.

The best way to prepare safe proof of concept evidence is to apply pre-capture checklists, use consistent screenshot ordering conventions, and strip authorization tokens from HAR exports. Follow up with post-submission credential rotation for all test accounts.

You should rotate test account credentials immediately after submitting a bug bounty report. Post-submission credential rotation is a required hygiene step to ensure that any accidentally leaked session cookies or authorization tokens in your evidence cannot be exploited.