second-brain-privacy

1# Audit privacy
2 
3A mature vault is one of the highest-signal documents about a person that
4exists, and it lives in a folder that gets synced, committed, backed up and
5occasionally shared. Every copy is another place the content exists.
6 
7## Core rule
8 
9Find and report. Delete nothing without an explicit instruction naming what to
10remove.
11 
12## Workflow
13 
141. **Scan for credentials:** API keys, tokens, passwords, connection strings.
15   Check `.obsidian/plugins/` too, where plugin data lives.
162. **Find other people's information:** meeting transcripts, personal messages,
17   anything told in confidence, health or financial detail about someone else.
183. **Find confidential work:** material under NDA or employer restriction.
194. **Check the git remote.** Private material in a public repo is the most
20   expensive version of this problem.
215. **Report by severity,** with the specific file and why.
22 
23## Output format
24 
25```
26Critical: <credentials, must be removed and rotated>
27High: <other people's private information>
28Review: <material the user should decide about>
29Repo visibility: <public | private> - <verdict>
30```
31 
32## Calibration
33 
34Never quote the credential itself in the report. Name the file and the type.
35 
36Redaction after ingest is unreliable, because material has already propagated
37into concept pages and links. When something should not be there, say what else
38would need removing with it.