# Keep incident notes useful without copying secrets into them

Responders need evidence quickly, but the working record should not become a second store of credentials or unrestricted customer data.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Separate the summary from sensitive evidence

Write impact and operational state in terms the response team can use without embedding raw customer records. Link to restricted evidence when detailed data is necessary.

Do not paste access tokens, connection strings or complete environment dumps into the incident document. A fast diagnostic shortcut can create a long-lived exposure across exports, notifications and archives.

Use sanitised examples where they establish the mechanism. Keep real record identifiers only where the audience is authorised and the investigation requires them.

## Define access by response role

Identify who can read the live record, edit the current summary and access restricted attachments. External vendors or customer representatives may need a narrower view than internal responders.

Review inherited sharing settings when copying templates or inviting specialists. A document created in a broadly shared folder may expose more than the incident owner intends.

Keep stakeholder updates separate from the internal debugging record. They can share confirmed impact while omitting sensitive hypotheses and implementation details that are not useful to the audience.

## Preserve evidence without uncontrolled duplication

Record source locations and timestamps so investigators can retrieve the relevant material through approved tools. If evidence must be exported, apply the organisation's handling and retention process.

A screenshot can contain hidden context such as customer names or browser tokens. Review it before attaching it to a widely accessible record.

Treat post-incident reports as a new publication decision with their intended audience, rather than automatically copying every raw working note.

## Review access after the incident

Remove temporary participants and emergency grants when their work ends under the established policy. Keep the record available to the owners who must complete follow-up actions.

Document retention and deletion decisions with the responsible information owner. Do not invent one universal period for all incident material.

A useful review preserves enough evidence to learn and investigate while limiting unnecessary copies. The team should know where sensitive facts live and who can access them without turning the live summary into a secret repository.

## Sources

- [Google SRE: postmortem culture](https://sre.google/workbook/postmortem-culture/)