[{"data":1,"prerenderedAt":270},["ShallowReactive",2],{"/blog/safe-email-test-evidence":3,"/blog/safe-email-test-evidence-surround":260},{"id":4,"title":5,"authors":6,"badge":12,"body":14,"date":248,"description":249,"extension":250,"image":251,"indexable":253,"meta":254,"navigation":253,"path":255,"reviewedBy":256,"seo":257,"stem":258,"updated":248,"__hash__":259},"posts/3.blog/11.safe-email-test-evidence.md","How to Save Email Test Evidence Without Exposing Secrets",[7],{"name":8,"to":9,"avatar":10},"Helen","https://x.com/HelenDailyLife",{"src":11},"/images/authors/helen-editor.webp",{"label":13},"Evidence safety",{"type":15,"value":16,"toc":237},"minimal",[17,21,32,37,40,43,46,50,53,88,99,102,106,109,116,124,128,131,134,137,147,150,154,157,172,175,179,182,185,189,192,195,219,223,226,229],[18,19,20],"p",{},"A screenshot can prove that an email rendered incorrectly, but it can also publish a working reset link. A copied header can explain a delivery path while exposing an address, Message-ID, internal host or test correlation value. Good evidence preserves the fact needed to reproduce a defect and removes everything that does not support that fact.",[18,22,23,24,31],{},"Treat verification codes, magic links and password-reset URLs as credentials while they are valid. Redaction is not a substitute for expiry or revocation: if a real secret has already been shared, invalidate or rotate it first. GitHub's official guidance on ",[25,26,30],"a",{"href":27,"rel":28},"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository",[29],"nofollow","removing sensitive data from a repository"," likewise recommends revoking or rotating an exposed password, token or credential before attempting repository cleanup.",[33,34,36],"h2",{"id":35},"start-with-the-question-the-evidence-must-answer","Start with the question the evidence must answer",[18,38,39],{},"Write one sentence before collecting anything: “This evidence should show that…” Examples include “the mobile subject line overlaps the timestamp,” “the reset message arrived after its stated validity period,” or “the link points to the staging host.”",[18,41,42],{},"That sentence limits collection. A layout defect may need a cropped screenshot and viewport width, not the raw message. A delayed-delivery defect may need UTC timestamps and an anonymised correlation value, not the message body. A header-parsing defect may need a small synthetic header sample, not a customer's original message.",[18,44,45],{},"Prefer evidence created with dedicated test accounts and fictional data. Do not use a real customer's inbox merely because it already demonstrates the problem.",[33,47,49],{"id":48},"know-what-to-remove","Know what to remove",[18,51,52],{},"Review both visible and hidden data. Common sensitive elements include:",[54,55,56,60,63,66,69,76,79,82,85],"ul",{},[57,58,59],"li",{},"full sender and recipient addresses;",[57,61,62],{},"verification codes, one-time passwords and magic links;",[57,64,65],{},"every reset URL, including its query string and fragment;",[57,67,68],{},"passwords, API keys, cookies, authorisation fields and session identifiers;",[57,70,71,75],{},[72,73,74],"code",{},"Message-ID",", provider queue IDs and application correlation IDs;",[57,77,78],{},"internal hostnames, private IP addresses and non-public environment URLs;",[57,80,81],{},"names, phone numbers, locations, order details and unrelated message content;",[57,83,84],{},"browser tabs, bookmarks, notifications and desktop filenames captured around a screenshot;",[57,86,87],{},"image metadata when the collection tool preserves it.",[18,89,90,95,96,98],{},[25,91,94],{"href":92,"rel":93},"https://www.rfc-editor.org/info/rfc5322/",[29],"RFC 5322"," defines ",[72,97,74],{}," as a unique machine-readable identifier for a particular version of a message. It is valuable for controlled log correlation, but uniqueness is also why a public report usually needs a stable placeholder rather than the original value.",[18,100,101],{},"Do not forget URLs behind buttons. A screenshot may hide the destination, while copied HTML or a hover tooltip reveals the full token. Conversely, painting over visible text in an image does not remove a secret from the underlying HTML, PDF layer, issue description or attachment filename.",[33,103,105],{"id":104},"choose-the-smallest-safe-evidence-format","Choose the smallest safe evidence format",[18,107,108],{},"Use a cropped screenshot for visual position, wrapping, contrast or responsive layout. Use a short text excerpt for exact characters or parsing. Use a structured timeline for delivery delay. Use a synthetic message for a repeatable parser test.",[18,110,111,112,115],{},"Avoid attaching a full mailbox export when three lines prove the defect. Do not upload raw ",[72,113,114],{},".eml"," files to a broadly visible issue tracker by default: they can contain the full body, all header fields, remote-resource URLs and attachments.",[18,117,118,119,123],{},"Once Email displays received messages but does not provide an evidence-export or redaction guarantee. Its ",[25,120,122],{"href":121},"/tools/email-header-analyzer","email header analyser"," processes pasted header text locally in the browser and can help identify fields, but you remain responsible for deciding what can be shared.",[33,125,127],{"id":126},"redact-screenshots-safely","Redact screenshots safely",[18,129,130],{},"Make a copy and keep any unredacted original only in an approved, access-controlled location. Crop to the relevant component first. Then replace sensitive regions with opaque blocks; do not rely on blur, pixelation, translucent highlighting or placing a movable shape over editable content.",[18,132,133],{},"Export the redacted result as a flattened image. Reopen that exported file, zoom in and verify that the secret cannot be recovered by hiding a layer, copying text or increasing contrast. Check the image edges and surrounding browser chrome for addresses, tabs and notifications.",[18,135,136],{},"Use meaningful placeholders when context matters:",[138,139,145],"pre",{"className":140,"code":142,"language":143,"meta":144},[141],"language-text","[TEST_RECIPIENT]\n[VERIFICATION_CODE_REMOVED]\nhttps://staging.example/reset?[TOKEN_REMOVED]\nMessage-ID: \u003C[MESSAGE_ID_REMOVED]>\n","text","",[72,146,142],{"__ignoreMap":144},[18,148,149],{},"Keep the same placeholder for repeated occurrences only when showing that two values match is necessary. Otherwise, avoid creating a stable pseudonym that lets readers correlate unrelated reports.",[33,151,153],{"id":152},"redact-headers-and-links-without-destroying-the-bug","Redact headers and links without destroying the bug",[18,155,156],{},"Copy the minimum relevant fields into a new text file. Replace sensitive values; do not edit the only original evidence. Preserve field names, folding and delimiters if the defect concerns parsing.",[18,158,159,160,163,164,167,168,171],{},"For a delivery-order issue, an anonymised sample might retain ",[72,161,162],{},"Received"," timestamps while replacing hosts, addresses and queue IDs. For an authentication display issue, preserve result keywords such as ",[72,165,166],{},"spf=pass"," while replacing domains with reserved examples like ",[72,169,170],{},"sender.example",". Explain every substitution in the report.",[18,173,174],{},"If a reset URL demonstrates the wrong hostname, keep only the scheme and sanitised host, then replace the complete path, query and fragment unless those components are the defect. Never preserve a partial real token: secret formats can contain account identifiers or remain usable after only a few characters are hidden.",[33,176,178],{"id":177},"separate-the-public-report-from-restricted-evidence","Separate the public report from restricted evidence",[18,180,181],{},"The main issue should contain the reproducible steps, expected result, actual result, environment, build and sanitised evidence. If an authorised security or privacy reviewer genuinely needs the original, place it in the organisation's approved restricted channel with an owner and deletion date. Do not casually attach it to chat.",[18,183,184],{},"Record who can access the restricted copy and why. Delete it when the investigation ends or the retention period expires. A long-lived archive of temporary verification messages creates risk without improving a closed defect.",[33,186,188],{"id":187},"review-before-upload","Review before upload",[18,190,191],{},"Use a two-pass review. First, the reporter checks every visible value, link target, filename and metadata field. Second, another authorised person checks the exported artifact as a recipient would see it. Open the exact file that will be uploaded, not the editable source.",[18,193,194],{},"Confirm that:",[196,197,198,201,204,207,210,213,216],"ol",{},[57,199,200],{},"no valid code, link, cookie or credential remains;",[57,202,203],{},"addresses and personal data are removed unless strictly necessary and approved;",[57,205,206],{},"identifiers are placeholders or stored only in a restricted channel;",[57,208,209],{},"the evidence still proves the stated actual result;",[57,211,212],{},"reproduction steps use test data and an authorised environment;",[57,214,215],{},"the issue's visibility matches the remaining sensitivity;",[57,217,218],{},"a retention or deletion decision exists for restricted originals.",[33,220,222],{"id":221},"if-a-secret-was-already-published","If a secret was already published",[18,224,225],{},"Stop sharing the link and contact the system owner. Expire or rotate the credential, invalidate affected sessions where appropriate, restrict the report, and follow the repository or issue system's cleanup procedure. Deleting the latest screenshot or commit may not remove cached copies, notifications, forks or history.",[18,227,228],{},"After containment, replace the artifact with a verified redacted version and document the exposure through the organisation's incident process. The goal is not to make the history look clean; it is to make the secret unusable, limit access and preserve enough safe evidence to fix the underlying defect.",[18,230,231,232,236],{},"For the complete functional workflow that produces this evidence, use the ",[25,233,235],{"href":234},"/blog/email-testing-checklist","developer email testing checklist",". Together, the two practices keep a mail-flow defect reproducible without turning its report into a second security incident.",{"title":144,"searchDepth":238,"depth":238,"links":239},2,[240,241,242,243,244,245,246,247],{"id":35,"depth":238,"text":36},{"id":48,"depth":238,"text":49},{"id":104,"depth":238,"text":105},{"id":126,"depth":238,"text":127},{"id":152,"depth":238,"text":153},{"id":177,"depth":238,"text":178},{"id":187,"depth":238,"text":188},{"id":221,"depth":238,"text":222},"2026-08-02","Create useful screenshots, headers and bug reports while removing verification codes, reset tokens, email addresses, identifiers and unrelated personal data.","md",{"src":252},"/images/blog/safe-email-test-evidence-cover.webp",true,{},"/blog/safe-email-test-evidence","Once Email privacy review",{"title":5,"description":249},"3.blog/11.safe-email-test-evidence","Qm4Q8jPGitXdM03Zcs88NBW245OMKZ1npwZ7SD9ack8",[261,265],{"title":262,"path":234,"stem":263,"description":264,"children":-1},"Email Testing Checklist for Developers: From Request to Expiry","3.blog/10.email-testing-checklist","A practical, authorised checklist for testing sign-up, verification and password-reset email flows without masking delivery defects or weakening security controls.",{"title":266,"path":267,"stem":268,"description":269,"children":-1},"Verification Email Not Arriving? A Safe Troubleshooting Checklist","/blog/anxiety","3.blog/2.anxiety","Work through address mistakes, sender delays, retries, filtering and mailbox limits without repeatedly requesting codes or weakening account security.",1785651954375]