Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 157 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I've observed several incidents where users inadvertently posted detailed, sensitive information. For example, a Server Fault user who posted a question with working login credentials to his actual production server, or the Stack Overflow user who posted actual medical records as example data for his question.

What should be the procedure for handling such cases?


Return to FAQ index

Return to Moderator FAQ index

share|improve this question

First, edit out the sensitive information.

This minimizes the damage by reducing the number of people who will see it casually.

Ideally, you'll have full edit privileges and can do this quickly; if you find yourself having to suggest an edit, then make sure you edit out all sensitive information - otherwise, your edit just blocks a more thorough editor and potentially leaves traces in the suggested edit history.

When you submit your edit, point out the issue you're correcting in the edit summary, but don't initially leave a regular comment as it will draw attention to the redacted information.

Second, flag for moderator attention with "other" flag, explaining why the sensitive information should be removed

Often, simply editing is enough... But in cases where someone could suffer serious consequences if the information remains visible on the 'Net (keys that can't be changed, 3rd-party medical information, etc.), you'll want to make sure it's thoroughly purged. Moderators can redact individual revisions to remove all traces of such information from both the post and its history; flagging will alert them to the nature of the problem.

If you don't have flag privileges (normally set at 15 reputation on launched sites), you should contact the Community Team using the "contact us" form - linked in the footer of every page on the site. This goes to Stack Exchange employees and no other users (including moderators) would be notified.

For moderators handling these flags

If the information appears dangerous, and especially if it involves someone who was not responsible for posting it, use the "redact" function on every revision which contains the information. Normally, this will be every revision listed in the revision history, however if it has been already edited out by someone (perhaps following the instructions above) it will tend to include only revisions up to but not including the latest.

Once you've redacted these, another moderator will need to approve your redactions (they can be found via the flag queue). This is done to avoid frivolous or misguided use of the tool to hide benign edits. When approving another moderator's redactions, have a talk with them if they do not appear to be warranted.

If you can't quickly redact problematic information in a given post, then delete it until you can.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .