12

Recently, I found a user had posted a complete copy of their credit card magstripe in a question on Security SE. As I did not have 2k rep on that site at the time I could not force an edit to hide the information.

I flagged the post, commented, edited, and tried to find someone on chat to help with this issue, but it took a while (~12 hrs), during which the complete card data was available (except for their name, which the user redacted, although they had a name on their account).

I reported the issue to the issuing bank, which should reduce the impact, but was this the correct way to handle this, and is there anything I should have done differently? Should a different procedure be followed for credit card numbers than for email addresses?

  • Note that, even now, the unredacted post edit history is visible to 10k users. Even non-10k users can see the original if they look at the edit suggestion link. – forest May 10 '18 at 0:30
14

Irrespective of any actions that you take outside of the site, I think that you should flag the post and ask the moderators of that site to redact the information:

When to redact revisions?

Even if you could edit the information out I think that it should also be redacted from earlier revisions.

Once it gets a mod's attention via a flag they can commence redacting and use their own mod room to get attention of another per-site mod to approve the redaction, and depending on the perceived urgency (this one looks urgent), raise it in the all-sites mod room to get the attention of an SE employee.

  • Would the best way to ask the mods be via flagging, or is there a room on chat that is good for raising these kinds of issues? – jrtapsell May 9 '18 at 23:00
  • If there is a suitable chat room where you (as presumably a non-mod) can raise this direct, then I am unaware of it. Once it gets a mod's attention via a flag they can commence redacting and use their own mod room to get attention of another site mod to approve the redaction or raise it in the all-sites mod room to get the attention of an employee. – PolyGeo May 9 '18 at 23:17
  • A flag has been open for several days now, since May 6th. – forest May 10 '18 at 0:32
  • 1
    @forest I'm trying to contact the Security mods now via the all-sites moderator chat room to see if they have seen the flag that you mention. – PolyGeo May 10 '18 at 0:50
  • @jrtapsell For really serious cases like this I'd recommend raising a flag and then seeking out any mod in chat. They have some tools that can get ahold of the site mods faster than a flag (as PolyGeo mentioned above) – ɥʇǝS May 10 '18 at 0:56
  • 3
    We (security mods) were aware of this shortly after it occurred. Unfortunately the redaction tool is being its usual annoying self and not allowing mods to redact. This needs a CM. – Rory Alsop May 10 '18 at 15:11
  • Sorry, for the uninformed, CM? – jrtapsell May 19 '18 at 18:50
  • @jrtapsell CM = Community Manager i.e. SE staff member – PolyGeo May 19 '18 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .