What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I've noticed recently there has been at least two incidents of users posting a lot of detailed sensitive information, from the guy the edited a post to replace it with his CV (which I would say is an interesting way of getting your name known) to the ServerFault user that posted a question with working login credentials to his actual production server.

What should be the procedure in this case?

  • Edit it out, if you have enough rep
  • Flag for moderator attention with "other" flag, explaining the contents?
  • As the revision history may need to be destroyed, drop into a chat room with a community co-ordinator and ping them to alert them of the situation?
  • Mention it in the parent's site chat room to draw attention to it?
  • Email team@stackoverflow.com with a link to the question and explain the issue?
  • All of the above?
share|improve this question
3  
I think this is definitely a good case for flagging for moderator attention. That's a good point about the edit history, I hadn't thought of that. –  vascowhite May 10 '12 at 12:38
1  
Ugh. I know this has been asked before, but I haven't been able to find the post. –  Al E. May 10 '12 at 13:10
    
Ah, here it is. Although the accepted answer there really isn't the preferred course of action. Look to the highest voted answer. –  Al E. May 10 '12 at 13:11
    
@AlEverettm while e-mailing is probably a good idea, I expect that email address gets a lot of mail so it's possible that it might take a while before anything is done about it. –  tombull89 May 10 '12 at 13:15
    
Yes, moderator flags are the best course of action. We have ways of getting in contact with the staff members, who can remove the revisions from the database. But please reserve this for really rare cases where it is absolutely necessary. –  Cody Gray May 10 '12 at 13:21
1  
I'm going to close those as duplicates of this, as this is really the canonical answer now. You can still email team, but this is a better in-site way of doing this. –  casperOne May 10 '12 at 13:21
2  
That is done, all of those questions now link to this as the canonical resource on this matter. The steps are (as others have posted) edit it out, flag for moderator attention, and possibly email team@so. –  casperOne May 10 '12 at 13:25
    
Thanks for this thread. Please note that HTTP Request Headers MAY CONTAIN sensitive info: GET /someurl.html HTTP/1.1 Authorization: Basic THISSTRINGISNOTENCRYPTEDITSOBVUSCATED== User-Agent: Internet Exploder Accept: / Pragma: no-cache I would flag these also if you see them. –  FlipMcF Jul 30 '13 at 21:25
add comment

3 Answers

up vote 20 down vote accepted
  1. Edit it out
  2. Leave a comment explaining to the OP why they shouldn't post sensitive data.
  3. Possibly flag the post so that the sensitive data can be removed from the revision history.

Most important IMO is the comment - that'll make sure that the OP is made aware of their errors. This might have an adverse affect of actually alerting other users to the presence of sensitive data but we are not in the business of damage control. If someone is going to do something malicious there is not much we can do to stop them.

We are not in the business of protecting other peoples data. Their data is of no concern to us. What we want out of this kind of issue is to make sure the OP realizes his/her mistake and for the data to be removed from the revision history.

share|improve this answer
6  
I agree it's important to make the OP aware of the issue so they can change password, but I'm not sure whether a public comment that draws attention to the issue (from other people) is the best solution... (but no, I don't have any other suggestions how to notify them :P) –  Matt May 10 '12 at 12:44
    
@mat - good point however we are not trying to protect the OP's data. Just showing him where he went wrong... Even with the possibly of alerting other users to the mistake letting the OP know about it should prompt a faster response... –  Lix May 10 '12 at 12:46
2  
@Matt - When editing a post you have the space for a comment - this can certainly point out that sensitive information was removed. –  Oded May 10 '12 at 12:49
    
@Oded: Aha, I hadn't thought of that... but I would be worried that new users wouldn't check there? –  Matt May 10 '12 at 12:53
2  
@Matt - Nor can you guarantee that they read a normal comment... –  Oded May 10 '12 at 12:55
3  
Generally I would not recommend a public comment, as it draws attention to the data. But I +1'ed anyway when I came across your comment, @Lix, "We are not trying to protect the OPs data"; That is - it's not our responsibility to protect that information (it was the OPs), and who knows - the damage could have been done before we saw it. But we've already done what we can to minimize it and fix it, and letting them know for the future could be useful. –  Andrew's a Unitato May 10 '12 at 14:49
    
Great answer Lix, though I would suggest swapping comment and flag and making the flag recommended rather than optional. If you comment about the sensitive data before the offending revisions have been removed from the revision history then you are just drawing attention to the problem. Commenting after the purge is safe though and would be useful to remind people to be careful not to post sensitive data. –  Mark Booth Oct 23 '12 at 9:17
add comment

Edit it out, if you have enough rep

Yes, certainly as a first step. Minimize damage.

Point out the issue in the edit comment, though not initially in a regular comment (as it will draw attention to the redacted information).

Flag for moderator attention with "other" flag, explaining the contents?

As a second step, and also ask to destroy any of the revision history that contains such information.

More than that is not needed, so long as it is actioned.

share|improve this answer
add comment

Do

  • Edit it out, if you have enough rep.
  • Vote to delete, if you have enough rep. (We can always undelete after the revision is gone)
  • Flag for moderator attention with "other" flag, explaining the contents. It would be helpful if you included a link to the revision (assuming you edited).

As for chat: If you are in a chatroom and a SE employee or a moderator happens to be around, it could be useful to mention it to them. But just dropping it in chat wouldn't be advisable, you will bring attention to it but you don't know what kind of attention that would be.

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .