From 160b41e50662b2a1e2638807d9dd5290a2a79252 Mon Sep 17 00:00:00 2001 From: shreyas-blacksmith Date: Thu, 22 Oct 2026 19:25:22 +0000 Subject: [PATCH] docs: Document customer privacy before publication Prevent private customer context from entering public contributions. Add pre-publication anonymization instructions to the contributor policy already required by AGENTS.md, preserving that delegation. Signed-off-by: Codesmith Staging Co-authored-by: Codesmith Staging --- CONTRIBUTING.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 88a3627bc3..2bc3ff7e90 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -259,3 +259,28 @@ Assisted-by: Claude:Opus-4.6 CodeQL Maintainers reserve the right to request additional clarification or decline contributions where LLM usage raises concerns. Ultimately, acceptance of any contribution is at the maintainers' discretion. + +## Customer privacy before publication + +Before creating or updating public content, contributors and agents must +anonymize private customer context in PR titles, bodies, comments and reviews; +branch names and commit messages; and committed code, tests, fixtures and +documentation. Never copy private customer data from support threads, +investigations, logs or connected sources here. + +Remove customer names; organization, repository, domain, tenant and account +identifiers; identifying keys, paths and log excerpts; and private customer job, +support or incident links. Keep credentials, known tokens and secrets private. +Use neutral wording, synthetic data and minimal reproducible examples. + +Check screenshot and recording pixels, captions and filenames before publication. +Use synthetic reproductions or keep identifying evidence private. Publishing +first and scrubbing later is unacceptable. + +Preserve this repository's public identity, dependencies and intentionally public +attributions, including public authors and third-party software. Do not add a +real customer-name blacklist. + +For existing inadvertent disclosures, stop propagating them and flag them +privately for authorized cleanup. Do not delete content or rewrite history +without approval.