handling-sensitive-test-data

Run an irreversible, deterministic transformation inside the production boundary before the data leaves it. Replace direct identifiers, generalize quasi-identifiers like birth dates and postcodes, drop free-text fields entirely, then run a re-identification check on a sample before use.

Use @faker-js/faker with a fixed seed so failures reproduce, and build factory functions with overridable fields. Use reserved domains like @example.com and reserved phone ranges so generated values are obviously fake and cannot reach real people.

Quasi-identifiers like date of birth, postcode, and gender re-identify most people when combined, even with names removed. Anonymization must generalize these fields and verify k-anonymity across combinations, otherwise the dataset remains personal data under GDPR.

Strip Authorization, Cookie, Set-Cookie, and X-API-Key headers and clear cookie arrays with a sanitization script run as part of the recording workflow. Header stripping does not cover response bodies, so record against synthetic data whenever possible.

Rotate the secret immediately, since it persists in history, clones, and forks even after the file is deleted. History rewriting with git filter-repo or BFG is optional cleanup; rotation is the only step that actually remediates the exposure.

Only when a specific constraint cannot be met by generated data, such as a required distribution or legacy record shape. The copy must go through an irreversible pipeline with a re-identification check, recorded approval, and a deletion date with a named owner.