Redact real IP addresses, hostnames, and domain names in client reports - Redact actual data (patient records, credit card numbers, passwords) - Use consistent redaction (black bars, [REDACTED] text) --- be thorough - Never redact the vulnerability itself; redact only sensitive data