A Security Checklist Before Sharing Code
Check secrets, personal data, internal URLs, and hidden context before publishing a code snippet.
Remove secrets, not just passwords
API keys, tokens, private keys, webhook signatures, cookies, and signed URLs can all grant access. Search the snippet and its comments for values copied from environment files, logs, or dashboards.
If a real secret was published, deleting the post is not enough. Revoke or rotate the credential immediately because copies and caches may remain.
Protect people and infrastructure
Replace customer names, email addresses, IDs, domains, IP addresses, database names, and internal paths with clear fictional values. Screenshots often reveal information outside the highlighted lines.
Check browser tabs, terminal prompts, filenames, and window titles when capturing a larger screen. Cropping after capture is less reliable than preparing a clean source first.
Keep the example honest
Redaction should not change the behavior being taught. Use placeholders with the same type and shape, and explain when security-sensitive setup has intentionally been omitted.
Do one final read as an outsider: ask what this code reveals about the application, users, and environment. Publish only when the lesson remains useful without private context.