How to share a bug report screenshot safely

The short answer

Crop the screenshot to the part that shows the bug, paste it into Blur screenshot with Ctrl+V (Cmd+V on Mac), accept the highlighted keys, emails and IDs, and cover anything else that belongs to a customer or to your infrastructure. Use solid boxes for anything secret.

Bug reports travel further than you expect. A screenshot pasted into an issue tracker, a public GitHub issue or a vendor's support ticket can be read by people outside your team, and it often stays there for years.

What leaks in bug report screenshots

• Dev tools: request headers with Authorization tokens, cookies in the Application or Storage tab, and API responses full of user records.
• The address bar: query strings with session IDs, reset tokens or email addresses.
• Terminals and logs: environment variables, connection strings, internal hostnames and IP addresses.
• Admin screens: customer names, emails, phone numbers, order details and payment information.
• Error pages: stack traces with file paths, usernames and server names.
• The rest of the screen: other tabs, Slack notifications, bookmarks and your own email.

Clean the screenshot

1. Crop to the area that shows the problem. Less on screen means less to check.
2. Paste into Blur screenshot. API keys, tokens, JWTs, private keys, emails, phone numbers, IP addresses and URLs are highlighted.
3. Use Find and redact for internal names: type a hostname, a customer ID pattern or a regular expression, and every match is covered.
4. Draw boxes over anything still visible that you wouldn't paste into a public chat.
5. Choose Solid for secrets and IDs, then download. The export is read again and anything still legible is flagged.

If several screenshots go with one report, add them together (up to 20) and download one PDF or a ZIP, so the same Find and redact rule applies to all of them.

Keep the useful parts

A good bug report still needs to be useful. Leave visible what helps someone reproduce the problem: error codes, the shape of a request, field names, version numbers. Replace a customer's real email with a box, not the whole form. When in doubt, describe the hidden value in the report text, for example noting that the token was valid and unexpired.

If a secret was already in a screenshot you shared, covering it now doesn't undo the leak. Rotate it. How to blur an API key in a screenshot explains how to handle that, and What to hide in screenshots has a general checklist.