evidence-hygiene

Name: evidence-hygiene
Author: elementalsouls

3.0kstars461forks

How to install evidence-hygiene?

elementalsouls/claude-bughunter/evidence-hygiene

$npx -y skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene

Installs into the current project.

Summary

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs wh

Files · 1

View on GitHub

SKILL.md

1	# EVIDENCE HYGIENE — PoC Capture & Redaction Discipline
2
3	> Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.
4
5	The core principle: Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.
6
7	---
8
9	## 1. Two Categories of Sensitive Data
10
11	Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.
12
13	\| Category \| Examples \| Treatment \|
14	\|---\|---\|---\|
15	\| Your-account secrets \| Session cookies, OAuth tokens, refresh tokens, API keys \| Always redact. Even in private bug-bounty platform attachments. Your account, your session — protect it. \|
16	\| Other users' PII \| Real names, emails, phone numbers, addresses, profile photos, account IDs \| Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display. \|
17	\| Triager-useful metadata \| Trace IDs (`x-datadog-trace-id`), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes \| Leave visible — these help the triager correlate to logs and reproduce. \|
18	\| Test-account passwords (limited use) \| Throwaway passwords on a test account (e.g., `Testing@5678`) \| Acceptable in screenshots if you rotate immediately after submission so the value shown is dead. Don't leave real-use passwords in evidence. \|
19
20	---
21
22	## 2. Cookie Redaction Protocol
23
24	### 2.1 What must be masked
25
26	The session cookie value is the highest-value secret in any PoC. Mask:
27
28	- The session cookie (`authn`, `session`, `sid`, `__Secure-id`, etc. — name varies per target)
29	- `csrf-token` if it's bound to your session
30	- `Authorization` headers (Bearer tokens, JWT)
31	- `Cookie` request header values for any session-bearing cookie
32	- `Set-Cookie` response header values for any session-bearing cookie
33
34	### 2.2 What's safe to leave visible
35
36	- Cloudflare cookies (`__cf_bm`, `_cfuvid`) — these are bot-management, not session-bearing
37	- Analytics cookies (`ajs_anonymous_id`, `_ga`)
38	- Trace correlation IDs (`x-datadog-trace-id`, `x-request-id`)
39	- Server / framework headers (`Server: cloudflare`, `X-Frame-Options`)
40	- Your test account email/UID (per Bugcrowdninja alias section in `bugcrowd-reporting`)
41
42	### 2.3 Redaction methods (ranked by practicality)
43
44	Method A — Don't capture the cookies in the first place (preferred when possible)
45	- For DevTools Console PoCs: use `credentials: 'include'` so the browser sends cookies automatically. Console output won't echo the cookie. Screenshot the Console output, never the Network tab Headers panel.
46	- For Burp Repeater PoCs: drag the bottom request/response panel divider DOWN to hide the request body before screenshotting. Capture only the Results table for Intruder runs.
47
48	Method B — Black-bar in image editor (when capture inevitably includes cookies)
49	- macOS: Open screenshot in Preview → Tools → Annotate → Rectangle → set fill color to black → drag rectangle over the cookie value → save
50	- Windows: Use Snip & Sketch's annotation tools or any image editor (Paint.NET, etc.)
51	- Burp itself: in Burp's Proxy → Match and Replace, you can pre-emptively redact cookie values to placeholder strings before screenshotting
52
53	Method C — Find/replace in raw text (for HAR files, terminal transcripts)
54	- See §4 for the jq commands
55
56	### 2.4 Pre-screenshot checklist
57
58	Before clicking Capture:
59
60	```
61	[ ] Network tab Headers panel is collapsed or out of frame
62	[ ] Burp's Request panel is hidden behind the divider drag
63	[ ] No "Copy as cURL" output is visible on screen
64	[ ] DevTools Application → Storage → Cookies tab is closed
65	[ ] Browser URL bar doesn't show a session token in query string (rare but possible)
66	```
67
68	After capturing:
69
70	```
71	[ ] Open the screenshot at

People who liked this also viewed

6 picks

Type

evidence-hygiene

3.0kstars461forks

View on GitHub

How to install evidence-hygiene?

elementalsouls/claude-bughunter/evidence-hygiene

$npx -y skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# EVIDENCE HYGIENE — PoC Capture & Redaction Discipline
2
3	> Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.
4
5	The core principle: Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.
6
7	---
8
9	## 1. Two Categories of Sensitive Data
10
11	Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.
12
13	\| Category \| Examples \| Treatment \|
14	\|---\|---\|---\|
15	\| Your-account secrets \| Session cookies, OAuth tokens, refresh tokens, API keys \| Always redact. Even in private bug-bounty platform attachments. Your account, your session — protect it. \|
16	\| Other users' PII \| Real names, emails, phone numbers, addresses, profile photos, account IDs \| Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display. \|
17	\| Triager-useful metadata \| Trace IDs (`x-datadog-trace-id`), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes \| Leave visible — these help the triager correlate to logs and reproduce. \|
18	\| Test-account passwords (limited use) \| Throwaway passwords on a test account (e.g., `Testing@5678`) \| Acceptable in screenshots if you rotate immediately after submission so the value shown is dead. Don't leave real-use passwords in evidence. \|
19
20	---
21
22	## 2. Cookie Redaction Protocol
23
24	### 2.1 What must be masked
25
26	The session cookie value is the highest-value secret in any PoC. Mask:
27
28	- The session cookie (`authn`, `session`, `sid`, `__Secure-id`, etc. — name varies per target)
29	- `csrf-token` if it's bound to your session
30	- `Authorization` headers (Bearer tokens, JWT)
31	- `Cookie` request header values for any session-bearing cookie
32	- `Set-Cookie` response header values for any session-bearing cookie
33
34	### 2.2 What's safe to leave visible
35
36	- Cloudflare cookies (`__cf_bm`, `_cfuvid`) — these are bot-management, not session-bearing
37	- Analytics cookies (`ajs_anonymous_id`, `_ga`)
38	- Trace correlation IDs (`x-datadog-trace-id`, `x-request-id`)
39	- Server / framework headers (`Server: cloudflare`, `X-Frame-Options`)
40	- Your test account email/UID (per Bugcrowdninja alias section in `bugcrowd-reporting`)
41
42	### 2.3 Redaction methods (ranked by practicality)
43
44	Method A — Don't capture the cookies in the first place (preferred when possible)
45	- For DevTools Console PoCs: use `credentials: 'include'` so the browser sends cookies automatically. Console output won't echo the cookie. Screenshot the Console output, never the Network tab Headers panel.
46	- For Burp Repeater PoCs: drag the bottom request/response panel divider DOWN to hide the request body before screenshotting. Capture only the Results table for Intruder runs.
47
48	Method B — Black-bar in image editor (when capture inevitably includes cookies)
49	- macOS: Open screenshot in Preview → Tools → Annotate → Rectangle → set fill color to black → drag rectangle over the cookie value → save
50	- Windows: Use Snip & Sketch's annotation tools or any image editor (Paint.NET, etc.)
51	- Burp itself: in Burp's Proxy → Match and Replace, you can pre-emptively redact cookie values to placeholder strings before screenshotting
52
53	Method C — Find/replace in raw text (for HAR files, terminal transcripts)
54	- See §4 for the jq commands
55
56	### 2.4 Pre-screenshot checklist
57
58	Before clicking Capture:
59
60	```
61	[ ] Network tab Headers panel is collapsed or out of frame
62	[ ] Burp's Request panel is hidden behind the divider drag
63	[ ] No "Copy as cURL" output is visible on screen
64	[ ] DevTools Application → Storage → Cookies tab is closed
65	[ ] Browser URL bar doesn't show a session token in query string (rare but possible)
66	```
67
68	After capturing:
69
70	```
71	[ ] Open the screenshot at

People who liked this also viewed

6 picks

Type