privacy and content ownership

why

publication is irreversible: once private material reaches a public surface it is indexed, archived, and searchable forever. the invariant: nothing crosses an audience boundary without an affirmative owner decision — safe default is preserve. accessibility is not permission; automation reaching a payload grants no redistribution right. explicit per-document classification keeps the decision durable as files move between folders, surfaces, and pipelines.

rule

classify content and data at the owner boundary. private source material, credentials, account data, and operational metadata are never published by default.

payloads or private identifiers published without an explicit decision leak into search indexes, public repositories, and archived pages.
attackers discover the patterns and search your infrastructure for similar data.
one published account snapshot becomes a security incident and a privacy breach: notify affected users, purge archives, GDPR/regulatory fallout.
default is preserve; every publication needs affirmative consent from the data owner.

practice

record visibility and use restrictions in content frontmatter.
keep secrets in project-local environment files or platform secret managers.
render only content explicitly cleared for the destination surface.
treat browser sessions, connectors, and provider data as private.

classify before storage, indexing, or rendering

class	allowed handling	prohibited handling
public, owner-cleared content	render on its approved public surface with declared provenance	extending that approval to unrelated destinations.
private authored standard or case study	store/index within its private corpus and render only to authorized readers	treating repository access as public distribution permission.
licensed or mirrored source material	retain only under its declared content policy and usage restriction	public deployment, redistribution, or derivative publication without an explicit new decision.
operational/account/provider data	inspect only for the active task and keep protected diagnostics minimal	copying it into docs, fixtures, prompts, logs, or chat summaries.
credential/secret	keep in local environment/secret manager; refer only by name	reading, printing, committing, or transmitting its value.

release decision

visibility is an explicit contract, not a side effect of a URL, repository, or connected account. before a document, data set, or generated page reaches a new audience, identify source owner, content policy, destination, and approval. if any is unknown, preserve the more-private boundary and record the unresolved decision rather than inferring permission.

tempting shortcut	failure	selected direction
publish because a source was reachable by automation	access does not grant redistribution rights	retain source policy and require destination approval.
copy private examples into generic guidance	identifiers and business context leak through otherwise useful details	generalize facts while preserving technical reasoning.
log raw provider/browser output for debugging	diagnostics become a second private data store	log only causal, redacted, actionable context.
mark a whole folder public/private without frontmatter	moved files silently change exposure	declare visibility/content policy per document where consumed.

verification

review frontmatter and rendering routes for every changed content class.
search the focused diff for credentials, private identifiers, account payloads, source-mirror text.
confirm indexes and logs expose only audience-authorized metadata/content.
record any new publication decision before deploying it.

do not

commit secrets, distribute mirrored source material, or infer permission from accessibility.

good and bad

bad

---
title: provider response example
---

customer id: cust_2f8b9c3e_phoebeyutbt
account name: Acme Enterprises
API key: sk_live_abc123def456
credit balance: $4,250.00
vendor name: preferred-supplier-2026

an accessible payload is copied into a document without deciding whether its owner permitted that destination. the document publishes in a public troubleshooting guide and indexes in Google. an attacker searches the customer ID pattern, finds three more examples in archived repositories — real API keys, customer names, financial data. a customer is compromised; the team must notify them, revoke keys, coordinate with compliance. a one-line payload published without consent became a security incident and a data breach.

good

visibility: private
content_policy: internal-guidance

the document declares audience and policy; examples keep only generalized, authorized technical facts. the decision becomes durable metadata instead of memory: files carry their classification across folders, pipelines, and surfaces, and consumers check frontmatter before rendering instead of inferring permission from accessibility. accidental exposure stops being a plausible failure mode; deliberate publication becomes one recorded approval.