What is the recommended practice for privacy when reporting defects?

• A. Redact sensitive data and avoid collecting PII.
• B. Attach raw logs with PII.
• C. Use production data with minimal redaction.
• D. Ignore privacy altogether.

Answer: (A)

Protecting user privacy while sharing defect details is essential. The recommended practice is to redact sensitive data and avoid collecting personally identifiable information (PII) in defect reports. By masking or removing fields like names, emails, phone numbers, account numbers, IP addresses, and other identifiers, you can still convey the technical issue—such as error messages, stack traces, steps to reproduce, and relevant configuration details—without exposing people’s information. This approach reduces the risk of data leaks, helps comply with privacy laws and company policies, and maintains user trust.

Attaching raw logs with PII can reveal sensitive information to anyone who accesses the report. Using production data with minimal redaction still risks exposing PII. Ignoring privacy altogether is unsafe and unethical. Using sanitized or synthetic data in place of real PII is a safer, more responsible practice that achieves debugging goals without compromising privacy.