45

I noticed while approving a redaction, that suggested edits may retain text which is later redacted.

With a bit of mod collusion with Community ♦ and another helpful moderator, I was able to reproduce the problem and provide screenshots without exposing legitimate credentials.

  1. I asked an outstanding question, but accidentally left credentials in the post:

    Image depicting question with secret key exposed

  2. A helpful user who hasn't yet received editing privileges (including anonymous users) came around to fix the typo in my post and re-worded the question to make it more likely to receive a good answer.

  3. I realized I left my credentials in the post, panicked, and raised a flag asking a moderator to redact the token.

  4. Rob ♦ graciously redacted the token for me, what a great guy!

    Image depicting revision history with revisions marked as redacted

And indeed the token is not visible in the actual question either:

Image depicting question with token redacted

Everything worked out in the end! But, I've got a bad memory - so I went back to check exactly what that helpful user edited for me, and lo:

Image showing suggested edit review containing the redacted token

It looks like I was wrong - that helpful user wasn't so helpful! I guess I didn't forget to hide my credentials after all - someone got a hold of them and is trying to get me in trouble with my boss.


This was mentioned here years ago (emphasis mine):

otherwise, your edit just blocks a more thorough editor and potentially leaves traces in the suggested edit history.

However, I haven't found any bug reports detailing this issue. Though it's a minor thing, it does break redactions quite badly, even though they're admittedly not a good way to fix credentials accidentally being exposed to the public.

6
  • 22
    You just earned the badge [bug-teller], awarded to users that make their bug reports read like a page-turner ....
    – rene
    Commented May 28, 2019 at 6:36
  • 2
    Rob (ban - 2 prior review bans) ♦ smiles viciously Commented May 28, 2019 at 17:32
  • 4
    @iBug Hmmm, he also approved this edit to a blatantly off-topic question, should I ban him a third time? :)
    – ert
    Commented May 28, 2019 at 18:05
  • I'm assuming this issue is still occurring? (I'm just removing and readding the [status-review] tag to ensure that we're tracking this issue internally.)
    – V2Blast
    Commented Aug 24, 2022 at 18:30
  • 1
    Quick tip: if a suggested edit fails to address sensitive information, reject it as spam, so it's hidden from logged-out users. Commented Aug 24, 2022 at 19:32
  • 1
    @V2Blast Yep, it's still happening (Example post is here with the exposed data here)
    – ert
    Commented Aug 25, 2022 at 0:38

1 Answer 1

12

We adjusted the redact functionality to also affect suggested edits. From now on, all redactions will also redact text in related suggested edit.

The redactions performed up to this date will not be affected. It is however possible to perform another redaction on the historical posts - and the new action will redact the suggested edit. Hope that helps!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .