How I scrub a story before it goes up

Every post on this site starts as something that really happened. Before it's published, it goes through the same pass so the lesson survives and the identifying detail doesn't. If you want to write about your own work in public, this is a reasonable place to start.

#Wait before writing

I don't post about anything still in progress, and I don't post about a security issue until it's fixed and has stayed fixed. A few weeks or months of delay also breaks the link between "the city's systems were down on Tuesday" and "a blog post about an outage appeared on Wednesday."

#Change what doesn't matter

The useful part of a story is usually the decision, not the setting. So I change:

• Department names and headcounts, when they aren't the point
• Dates, seasons and the order of unrelated events
• The size of the city, the number of sites and the number of users, rounded or shifted
• Vendor names, unless the product itself is the subject and the post is factual

If a detail is load-bearing, like the fact that a system only supports SMS, I keep it and drop something else instead.

#Redact screenshots properly

Screenshots leak more than prose. Before one goes up I check it for:

Crop or cover with solid shapes, don't blur. Blurring and pixelating can sometimes be reversed, and a black box drawn over text in a PDF often leaves the text underneath selectable. Export to a flat image after redacting.

#Strip metadata

Photos and documents carry their own history: camera model, GPS location, author name, software version. I clear it from every image before upload.

# Remove all metadata from every image in the folder, keep no backup copies
exiftool -all= -overwrite_original ./images/

# Confirm nothing is left
exiftool ./images/screenshot.png

On Windows, Properties → Details → Remove Properties and Personal Information works for a one-off, but it's easy to miss a file, so I prefer the command line.

#Think about the reader with bad intentions

The last check is the one that matters most. I reread the post as someone who wants to break into a city network and ask: does this tell them which product we run, which version, which gap we haven't closed, or who to phish? If it does, it gets cut or generalized. "A legacy system that can't do modern authentication" teaches the same lesson as the product name and version, and helps nobody attack it.

#Keep it off the work clock

Two habits keep the blog separate from the job. I write and publish from personal devices and accounts, never city equipment or the city network, and I check the employer's social media and outside-activity policy before writing anything at all. In public sector work that separation matters more than usual, because anything created on a work system may be a public record.

#The checklist

• The issue is resolved, and some time has passed
• Names, places, dates and sizes are changed where they don't matter
• Screenshots are cropped or covered, not blurred, and exported flat
• Metadata is stripped from every image and attachment
• Nothing in the post helps someone target a real system
• Written on personal time, devices and accounts