Reduce the payload before masking
Remove unrelated branches, repeated records, binary content, and fields that do not contribute to the issue. Smaller examples are easier to review and less likely to leak information.
Keep enough nesting to demonstrate the problem. Replacing the entire object with a flat summary may remove the structure the support team needs.
Mask keys and values recursively
Review keys such as name, email, phone, address, password, token, secret, access_token, refresh_token, user_id, customer_id, patient_id, account, and notes.
Arrays require special care because they may contain hundreds of records. A clean first object does not mean later objects are safe.
Preserve useful data types
When the type matters, replace a string with another string, a number with a safe example number, and a timestamp with a synthetic timestamp. This prevents the redaction itself from changing application behavior.
Use consistent placeholder IDs when relationships matter. If order.customer_id refers to customer.id, both should use the same synthetic value.
Validate the final example
Parse the output again to confirm it remains valid JSON. Then search for @ signs, long tokens, URLs, names, IDs, and organization-specific fields.
Treat embedded JSON strings as a separate document. They may contain another layer of private data that a normal object walk will not parse.
Final review checklist
- Payload reduced to a minimal sample
- Nested objects and every array item reviewed
- Tokens and passwords fully replaced
- Relationships use consistent synthetic IDs
- Output parses as valid JSON