A useful bug report often needs a realistic payload, but production JSON can contain credentials, session identifiers and personal information far below the first level. Safe sharing requires recursive inspection, value-aware detection and a final human review.

Search keys recursively

Start with key names such as password, secret, token, api_key, authorization, cookie, session and private_key. Match spelling variations, separators and casing. Apply the rule to every object depth and to objects stored inside arrays.

Key matching is only a first pass. A credential may live under a generic key such as value, header or data. Conversely, a field named token_count may be harmless. Record every redacted path so a reviewer can verify what was changed.

Inspect recognizable values

Detect email addresses, IP addresses, bearer tokens, structured API-key prefixes and long high-entropy strings where appropriate. Context matters: randomly generated identifiers may be public, while an ordinary-looking customer number may be sensitive.

Prefer replacement with an explicit marker such as [REDACTED] rather than an empty string. A marker makes the transformation visible and preserves the fact that a value existed, which helps other people understand the payload shape.

Preserve useful structure safely

Replace secrets without removing their keys when the key is necessary to reproduce parsing or validation behavior. For personal values, use syntactically realistic reserved examples: example.com email addresses and documentation IP ranges communicate format without identifying a real person or system.

If the defect depends on string length or character class, generate a same-shape placeholder rather than retaining any part of the original secret. Never publish a live prefix merely because the final characters were masked.

Assume shared text will persist

Chat messages, issue trackers and copied snippets may be indexed, forwarded or retained in backups. Revoking a credential after accidental disclosure is necessary even when the message is later deleted.

The best control is to prevent sensitive values from entering logs in the first place. Centralize structured logging, maintain an allowlist of safe fields and test redaction against nested fixtures. Use a browser-side redactor as an additional check, not as the only security boundary.

Practical takeaways

  • Inspect keys at every nesting level.
  • Combine key and value detection.
  • Use explicit, realistic reserved placeholders.
  • Revoke credentials after any real disclosure.

How this guide was prepared

JSON Anvil guides are written for working developers, checked against reproducible examples, and reviewed for technical clarity. Tool output is tested locally; readers should still validate behavior in the exact runtime used by their application.