Skip to main content

Security and Sensitive Content

Summary​

This standard defines visibility classifications and prevention controls for secrets and sensitive information.

Audience​

  • Documentation authors
  • Security reviewers
  • Documentation owners

Reference Content​

Public versus internal content​

The visibility field defines the intended audience boundary:

  • public: Approved for unrestricted access.
  • partner: Approved for authorized partners.
  • customer: Approved for authenticated customers.
  • internal: Restricted to authorized personnel.
  • confidential: Restricted by explicit need-to-know controls.

Visibility is not a substitute for access control. Publishing systems must enforce the declared boundary.

Prohibited content​

Never publish secrets, passwords, tokens, private keys, connection strings, recovery codes, personal data, customer data, confidential identifiers, or exploitable operational details. Use unmistakable synthetic placeholders in examples.

Do not copy logs, screenshots, exports, diagrams, prompts, or source files into documentation until they have been reviewed and sanitized.

Prevention and response​

  • Use approved secret scanning and content review before publication.
  • Apply least disclosure: include only what the audience needs.
  • Require security review for sensitive topics and confidential visibility.
  • Treat generated and AI-assisted output as untrusted.
  • If sensitive information is discovered, stop publication, restrict access, notify the authorized response owner, remove the material from current and historical delivery surfaces as required, and rotate exposed credentials through the approved incident process.

Security review must be repeated when visibility, examples, data sources, or delivery channels change.

See Also​

Keywords​

  • Sensitive information
  • Secret prevention
  • Visibility classification

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: documentation-team
  • Status: Approved