Review the actual files you received before sending them to an issue tracker, coding agent, chat, repository, or another person. Make any necessary changes in a safe working copy and verify the final files themselves.

Inventory the handoff

Compare the files present with session.md. A link in the summary does not guarantee the file exists, and a partial handoff may intentionally omit evidence. Review each supplied artifact:

Artifact	Check for
session.md, notes.md	Names, URLs, account or project details, copied payloads, and tester-authored conclusions
network.har	Query values, headers, cookies, credentials, request bodies, response bodies, and internal endpoints
console.log	Tokens, personal data, application payloads, stack paths, and internal URLs
steps.json, generated scripts	Recorded URLs, input values, selectors, comments, and test data
screenshots/	Sensitive pixels anywhere in the image, including browser chrome and background content

Automatic sanitization can cover selected structured values, but it does not certify the bundle as safe. Missing or truncated content is an evidence gap, not a privacy guarantee.

Choose a safe response

If a file contains material you cannot share, omit it from the destination or prepare a separately reviewed copy with an appropriate file-aware tool. Preserve the original only in an approved location. For screenshots, retake or edit a copy outside Recorder; there is no pixel-redaction control in the bundle.

Avoid ad hoc edits that make structured files invalid. After changing a HAR or JSON copy, parse it with the intended consumer and verify that the evidence you meant to preserve is still present. Never replace a redacted credential with a real production secret for convenience.

When the required evidence cannot be made safe or remains incomplete, ask the tester for a new reviewed export using safe test data. Name the exact request, field, message, action, or image needed.

Verify the destination

Send only the reviewed copies required for the task. Confirm that the destination received those files and no unintended siblings. Record exclusions that limit the conclusion.

Later edits cannot retract an earlier email, issue attachment, upload, or agent context. Treat each destination as an independent disclosure and follow its access and retention rules.