# Evidence Hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie...

- Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars)
- Category: Writing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill evidence-hygiene -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter`

## Description

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data, names, emails, phones, faces, vs what is safe to leave, usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# EVIDENCE HYGIENE, PoC Capture & Redaction Discipline

> Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.

The core principle: **Bug-bounty evidence is meant to convince a triager. Anything beyond that, live cookies, real-user PII, internal trace IDs that aren't useful, should not be in the evidence.**

---

## 1. Two Categories of Sensitive Data

Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.

| Category | Examples | Treatment |
|---|---|---|
| **Your-account secrets** | Session cookies, OAuth tokens, refresh tokens, API keys | Always redact. Even in private bug-bounty platform attachments. Your account, your session, protect it. |
| **Other users' PII** | Real names, emails, phone numbers, addresses, profile photos, account IDs | Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display. |
| **Triager-useful metadata** | Trace IDs (`x-datadog-trace-id`), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes | **Leave visible**, these help the triager correlate to logs and reproduce. |
| **Test-account passwords (limited use)** | Throwaway passwords on a test account (e.g., `Testing@5678`) | Acceptable in screenshots if you rotate immediately after submission so the value shown is dead. Don't leave real-use passwords in evidence. |

---

## 2. Cookie Redaction Protocol

### 2.1 What must be masked

The session cookie value is the highest-value secret in any PoC. Mask:

The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/evidence-hygiene/SKILL.md