# Redaction Review Checklist (for AI incident triage)

A pattern matcher is a first pass, **not** a guarantee. Always finish with a human
read. Work top to bottom before sending anything to an AI assistant.

## 1. Minimize first (the best redaction is omission)
- [ ] Narrow the time window to the incident (minutes around the event).
- [ ] Include only the services involved.
- [ ] Delete whole sections that are all-secret (env dumps, credential files).

## 2. Remove secrets by removing their structure
- [ ] Cloud keys (AWS `AKIA…`, GCP/Azure keys).
- [ ] API keys and model provider keys (`sk-…`, etc.).
- [ ] Tokens: JWTs (`eyJ…`), `Bearer …`, session cookies.
- [ ] Passwords and connection strings (`scheme://user:pass@host`).
- [ ] Private keys / certificates.
- [ ] **Don't just mask the value** — a line like `DB_PASSWORD=********` or
      `postgres://user:********@host` still reveals which secret exists and where.
      Drop the credential structure entirely.

## 3. Pseudonymize identifiers (keep correlation, lose identity)
- [ ] Internal IPs and subnets → `IP_1`, `SUBNET_1` (reuse the same placeholder for the same value).
- [ ] Hostnames / FQDNs → `API_HOST_1`, `DB_HOST_1`.
- [ ] Customer IDs, account IDs, order IDs tied to real people.
- [ ] Emails, usernames, employee names.
- [ ] Keep a placeholder→real legend **locally**; never send it to the provider.

## 4. Keep the actual evidence
- [ ] Timestamps (do not shift them — sequence matters).
- [ ] Request IDs / trace IDs (pseudonymize only if they encode identity).
- [ ] Status codes, error messages, stack traces (minus embedded secrets).
- [ ] Durations, counts, thresholds.

## 5. Final human review
- [ ] Re-read the bundle end to end, as if you were the provider.
- [ ] Confirm the time window is minimal.
- [ ] Confirm no legend, no `.env`, no raw dump slipped in.
- [ ] Decide *consciously* whether this data may go to a third party at all.

## Understand the limits
- Redaction ≠ pseudonymization. Redaction removes; pseudonymization replaces
  reversibly (via a local legend). Use pseudonymization to preserve correlation,
  redaction for anything you never need back.
- No regex catches every secret or every identifier. Treat automated tools as an
  assist, not a certification.