Blog Post Sanitization Checklist: What to Redact Before Publishing

The Incident That Started This

Yesterday, I wrote a blog post called "The Nightly Build" about my autonomous AI agent that runs security audits at 3 AM. Great content, timely topic, aligned with community discussions.

Then my AI assistant (Clawsistant) flagged something:

"Wait. You're about to publish specific cron job names, channel IDs, and exact deployment counts. This is operational security information."

Ouch.

I had written things like:

My `moltbook-lunch-scan` cron job (ID: 89dcec9f-5e45-4ef3-824b-1a4761779e54) 
runs at 12:00 PM PST and sends reports to Telegram channel -1003892593540.

That's three unique identifiers that could be used to:

• Identify my specific deployment
• Correlate logs or activity patterns
• Target attacks against known infrastructure

None of this was malicious. I just didn't think about it. I was focused on writing good technical content, not protecting operational details.

Why This Matters

Blog posts are permanent and public. Once published:

• They're indexed by search engines
• They're cached by archives (Wayback Machine, etc.)
• They can be quoted, shared, and screenshot
• You can't fully delete them (even if you remove the post, copies exist)

Unlike GitHub issues (where you can edit comments) or social media (where you can delete posts), blog posts should be treated as immutable.

So what do you redact?

The Redaction Rules

🔴 ALWAYS REDACT

✅ SAFE TO KEEP

Before/After Examples

My `moltbook-lunch-scan` cron job (ID: 89dcec9f-5e45-4ef3-824b-1a4761779e54) 
runs at 12:00 PM PST and sends reports to Telegram channel -1003892593540.

My daily Moltbook scan job runs at noon PST and sends reports to my Telegram channel.

What changed:

• ❌ Removed specific job name (moltbook-lunch-scan)
• ❌ Removed job ID (UUID)
• ❌ Removed exact time (12:00 PM → noon)
• ❌ Removed channel ID
• ✅ Kept timezone (PST)
• ✅ Kept functional description (what it does)

Validation: Automated Checks

Before publishing, I run these grep commands:

1. Check for UUIDs

grep -E "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" draft.html

Expected: No results ✅

2. Check for Telegram Channel IDs

grep -E "\-100[0-9]+" draft.html

Expected: No results ✅

3. Check for Specific Job Names

grep -E "moltbook-|healthcheck-|morning-" draft.html

Expected: Only in generic context (e.g., "Moltbook scan" not moltbook-lunch-scan)

4. Check for Full Paths with Usernames

grep -E "/home/[a-z]+" draft.html

Expected: No results ✅ (use ~ instead)

5. Manual Review

Read the entire post asking:

"Could someone identify my specific deployment from this?"

Check for combination leaks—multiple harmless details that together identify you.

Blog Posts ≠ GitHub Issues

I adapted this from my GitHub Issue Sanitization Checklist, but blog posts are different:

More Lenient (It's Your Content)

• ✅ Use your name (it's your blog)
• ✅ Mention your employer (public info)
• ✅ Share your architecture patterns
• ✅ Link to your GitHub and social profiles

But Still Protect

• ❌ Operational security (cron schedules, job names)
• ❌ Access patterns (specific channel IDs, monitored endpoints)
• ❌ Family privacy (children's details, school info)
• ❌ Financial privacy (exact compensation, account balances)

Key principle: Protect how your deployment works, not who you are.

The Checklist I Use Now

Location: I keep this checklist at memory/categories/blog-sanitization-checklist.md and review it before every post.

Lessons Learned

1. Operational Security > Anonymity

The goal isn't to hide who you are—it's to protect how your systems work.

• ✅ "I run security audits" (general capability)
• ❌ "My healthcheck-nightly-audit job runs at exactly 3:00 AM" (specific pattern)

2. Consistency Matters

Use the same sanitization rules across:

• Blog posts
• GitHub issues
• Social media (Moltbook, Twitter, etc.)
• Public discussions

Inconsistency creates leaks.

3. Automate What You Can

Don't rely on memory. Use grep commands, checklists, and validation scripts. Make it hard to forget.

4. Think in Combinations

Individual details might be harmless, but together they can identify you:

❌ "Oracle PMTS" + "HeatWave ML" + "Fremont CA" + "36M" = Specific person
✅ "Principal Architect" + "ML Infrastructure" + "Bay Area" = Many people

Why I'm Publishing This

Because I made this mistake. And if I made it, others will too.

The AI agent community is growing fast. People are building autonomous systems, running cron jobs, connecting to their personal data. We're sharing our experiences, our architectures, our lessons learned.

That's great. But let's do it safely.

Use this checklist. Adapt it. Improve it. But use something.

Your blog is permanent. Your operational security matters. Redact before you publish.