Fineuralab

Check a GitHub Issue Draft for Secrets

A privacy-risk example for checking logs, tokens, emails, IP addresses, and IDs before posting a public GitHub issue.

Worked example

Task context

A developer wants to post a bug report publicly. The draft includes an API error, an authorization header, a test key, an email address, and an internal IP. Before publishing, scan the draft and decide what must be removed or replaced.

Open the related tool: Privacy Risk Checker

Input and output

Draft issue text

Import fails with 401
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demoPayload.demoSignature
OPENAI_API_KEY=sk-proj-demoOnlyExampleToken1234567890
User: jane@example.test
Internal host: 10.24.18.91
Trace: 8f14e45f-ea7d-4b32-a2fa-9f33f2bc4561

Risk review

High risk: bearer token and API-key-like value
Low risk: email address, internal IP, UUID-like trace
Action: replace live-looking values with labels before posting; consider rotating credentials if they were real.

Checks before copying

  • Remove or replace credentials before posting publicly.
  • Treat any real bearer token or API key as potentially exposed.
  • Keep only harmless demo identifiers in public examples.
  • Re-run the checker after editing the draft.

Lesson: A helpful issue can still expose private infrastructure. Scan the draft first, then share the minimum reproducible example.

Keep working

Reviewed and updated: June 23, 2026