Build from a staging folder
Copy only the required files into a new folder rather than compressing an entire project, desktop, or user directory. This reduces accidental inclusion.
Use neutral folder names that do not reveal a customer, employee, private project, or local username.
Exclude high-risk files
Remove .env files, credentials, private keys, database dumps, logs, browser profiles, backups, temporary files, source maps, build caches, and editor settings when they are not required.
Hidden files such as .DS_Store and version-control folders can reveal paths, names, or repository history.
Inspect the final archive
Open the ZIP and review every member name and path. Extract it into a temporary folder and confirm that only the intended content appears.
Search text-based files for email addresses, tokens, passwords, internal domains, and customer identifiers.
Use passwords carefully
Archive encryption protects the file only when the password is strong and sent through a separate channel. Older ZIP encryption methods may be weak.
Encryption does not correct accidental inclusion. The recipient can still see everything after opening the archive.
Final review checklist
- Clean staging folder used
- Hidden and backup files excluded
- Paths and member names reviewed
- Text files scanned for secrets
- Password shared separately when encryption is used