I just witnessed a question from someone on Stack Overflow that, for some unknown reason, posted what appeared to be an array containing usernames, encrypted passwords, email addresses, phone numbers, IP addresses, etc., asking for help handling the array. Fortunately, the author removed the question, but not before dozens or hundreds of users saw this question and perhaps got indexed by search engines.

Besides flagging this question, are there any steps for Stack Exchange users to pursue in such a situation? If I were a client of this person, I'd want someone to tell me that they are incompetent and leaked some of my information.

Edit: Thanks for the responses. While I viewed the duplicate question, I feel these answers and comments are more appropriate, especially given the website changes over the past year. It was more a question of what can I do than what should I do. The answers and comments here also gave me some insight over attitudes of this kind of situation in an ethical and legal light.

  • 6
    Generally speaking, that is not our problem. We are never in a position to police external social or legal contracts. Jun 26, 2013 at 14:54
  • its the internet, once something has been seen once it remains there forever. it shows how idiotic the OPs idea was and I agree there should be a website of companies which broke the privacy laws ( intentionally or not ) for our future reference
    – user221081
    Jun 26, 2013 at 15:00
  • It may be stolen data as well, something to bear in mind.
    – Mansfield
    Jun 26, 2013 at 15:05
  • @MartijnPieters I understand what you're saying. However, I still feel like I'm ethically bound to do something else. Maybe it's a bit of an ego as well because of the steps I take to secure any information that is given to me as a professional.
    – BLaZuRE
    Jun 26, 2013 at 15:08
  • 1
    "If I were a client of this person, I'd want someone to tell me that they are incompetent and leaked some of my information." ... that's not gonna happen. Certainly not on an official SO/SE basis.
    – Bart
    Jun 26, 2013 at 15:09
  • 4
    @MartijnPieters - No, this is very much a concern for us. This isn't a contract issue, it's pretty clear what we need to do here. Someone posting personal information of others should be flagged so that we can edit and delete that information from the database. Jun 26, 2013 at 15:27
  • @MartijnPieters But it doesn't hurt to be accommodating, especially when it doesn't cost us much at all. Plus what Brad said above.
    – Adam Lear StaffMod
    Jun 26, 2013 at 15:27
  • @AnnaLear: agreed; flagging and requesting a delete is fine in this case; I did label my comment as the general case. Jun 26, 2013 at 15:28
  • What goes on the internet stays on the internet, unfortunately. If the page was cached somewhere (by one of the many SO clone sites, for instance), there's nothing SE can do to have it taken down. The best we can do is edit it out and have it erased from the database.
    – user200500
    Jun 26, 2013 at 15:37

2 Answers 2


Delete the sensitive data, and then flag the post; developers and community team members can remove the relevant revisions from the edit history.

If you feel charitable, you can also leave a comment to the user that they probably should be more careful about posting sensitive information in the future, but there's no obligation to do so.

I generally tell people that, once it is posted, information is on the Internet forever. This is the same argument I also give for people wanting to delete their homework assignments so that they don't get caught cheating by their professor; Google picks up new posts on Stack Overflow within minutes.

  • As I say here if you can't edit directly then flagging is in some ways better than suggesting an edit, as it draws less attention to the problem (it doesn't end up in the suggested edits queue). You certainly shouldn't comment as that brings it to the attention of even more people.
    – Mark Booth
    Jun 26, 2013 at 16:13
  • @MarkBooth: It's hard to imagine how the post hitting Google in the first 10 minutes or so attracts any less attention than an informative comment.
    – user102937
    Jun 26, 2013 at 16:20
  • True, though I'm not sure all stack exchange sites get the stack overflow treatment.
    – Mark Booth
    Jun 26, 2013 at 16:21

Not much you can do. This is their problem, especially if they are breaking a security or confidentiality contract or law. All we can do is edit it out as soon as we see it, but even then it's still in the revision history. You can flag the post though, as @Oded just told me that developers and community team members who are also moderators) can remove revisions. As a 10k user, I can also see the deleted post. The only kind of user who can fully delete from the database so that no one can see something is a SE Inc. developer.


Not the answer you're looking for? Browse other questions tagged .