Field guide / Reviewed October 31, 2026

Ask for better questions, not a verdict.

An AI assistant may help identify unsupported claims. It still does not know what happened in your environment.

The case notebook stays separate.

CaseNote's optional AI path accepts only the selected scenario and a new summary you write specifically for sharing. It does not automatically include case IDs, sources, timestamps, evidence entries, check notes or handoff fields. This separation reduces accidental copying of sensitive case context.

Your full Markdown and JSON handoff exports are different: they contain all case fields and are not redacted. Review their preview and use your approved internal destination.

Prepare only what the reasoning task needs.

1. Confirm your organization's policy permits the destination and this use.
2. Write a minimal summary using stable aliases such as user-A and host-B. Omit secrets, identifying context and raw logs.
3. Add exact removal terms for any names or internal identifiers still present.
4. Generate the prompt and read every line. Revise the summary if anything sensitive remains.
5. Approve this exact revision before copying. Any summary or removal-term edit clears approval.

OWASP's logging guidance identifies access tokens, session identifiers and other secrets as data requiring careful exclusion or handling. Its list is a useful reminder of what may be hidden in copied evidence, not proof that a redaction routine can detect everything. OWASP logging data exclusions.

Know the masking boundary.

The local helper masks selected labeled credentials, Bearer/Basic authorization strings, private-key blocks, JWT-shaped values, HTTP URLs, email addresses and IPv4-shaped strings. Exact removal terms are case-insensitive literal matches, including inside words. They may remove more text than intended.

It does not reliably recognize names, IPv6, internal hostnames, unlabelled or encoded secrets, sensitive business facts or identifying combinations. You must review the exact output. “Redacted” does not mean anonymous or approved for external disclosure.

A useful synthetic request.

“A training tool request was recorded and the tool returned queued. Approval and downstream completion records are unavailable. My hypothesis is that an unauthorized export may have occurred. Which parts are observed, which are inferred, and what evidence questions would distinguish alternatives?”

The prepared prompt tells the reviewer to treat evidence as untrusted and avoid executing commands, visiting indicators or inventing intelligence. Those instructions cannot guarantee a remote model's behavior. Review any answer against the original evidence and local playbook.

No model is connected to CaseNote. Copying a reviewed prompt is a local clipboard operation; pasting into another service is a separate action governed by that service and your organization. Privacy details.