Hello everyone,
I've been observing the discussions here for a while, primarily focusing on dashboard design and BI tool integrations, and I wanted to raise a point of concern that I've noticed increasingly in various technical forums, including some threads here. While I am relatively new to this community, I believe this is a matter of fundamental security hygiene that deserves reiteration, especially as our platform grows and attracts more members sharing their configurations and troubleshooting steps.
The practice of sharing screenshots is invaluable for debugging complex issues in tools like Tableau Server, Power BI Service, or Looker instance configurations. However, I have observed that screenshots sometimes inadvertently capture sensitive information in browser address bars, terminal windows, or configuration panels. Specifically, I am referring to the exposure of:
* API keys and client secrets, which are often passed as URL parameters during OAuth2 flows or initial setup of data connectors.
* Database connection strings that include usernames and passwords.
* Bearer tokens or session IDs visible in development tool panels.
* Any form of credential or unique secret that could grant access to a data source or service.
Once such an image is posted, even if removed later, it may have been cached, archived, or downloaded. The risk of credential leakage and subsequent unauthorized access is significant and often irreversible. The attacker does not need sophisticated methods; they simply need to see the exposed secret.
Therefore, I would like to respectfully suggest, and perhaps urge the moderation team to consider formalizing, a strong community guideline:
**Always review and redact any API keys, secrets, passwords, or tokens from screenshots before uploading them to the forum.**
A good practice is to double-check the entire image area, including:
- The browser's address bar.
- Any visible console output or terminal logs.
- Headers sections in API debugging tools (like Postman or browser DevTools).
- Environment variable panels in IDE screenshots.
- Configuration files, even if only partially visible.
Given that this is the Announcements subforum, I thought this might be an appropriate place to discuss whether this could be added to the official community rules or posting guidelines. It would serve as a critical reminder for all of us, especially when we are focused on solving a technical problem and might overlook a security detail in the background of our screenshot.