Screen images from a failed test run held real customer data and were already attached to a ticket and copied into a shared build cache - what does containment involve now?

## Containment is an inventory problem The instinct on discovering that a captured screen image holds real customer data is to delete it. Deleting it is the easy part, and it is not containment. From the moment evidence is produced it starts being copied, because being copied is what it is for: attached, quoted, cached, exported, downloaded and mirrored so that people can look at it later. Containment is therefore an act of enumeration first - find every copy - and only then an act of removal, over the subset you can actually reach. ## Where the copies are 1. **The run's evidence store.** The original. Usually deletable, often replicated internally, and sometimes swept into a backup on a schedule you do not control. 2. **The ticket attachment.** A second copy with a different owner, a different access list and its own retention. Deleting the first does nothing to it. 3. **The shared build cache and its mirrors.** Caches are replicated to agents by design, so one logical entry can be several physical files, and rebuilding an agent from a snapshot can restore what you removed. 4. **Messages and notifications that quoted the content.** Chat, mail, an alert body. These fan out to recipients you cannot enumerate and cannot recall. 5. **Search indexes and previews.** A thumbnail or an extracted text preview can outlive the file it came from. 6. **Local downloads.** Anyone who opened the image may hold a copy on a laptop, and nothing you control knows about it. | Copy | Typically reachable | What removal costs | | --- | --- | --- | | Evidence store original | Yes | Minutes | | Ticket attachment | Yes | Minutes, plus a note of what was removed | | Cache entry | Partly | An expiry or rebuild cycle, possibly a broken build | | Point-in-time backup | Rarely | Usually impossible to edit selectively | | Quoted message | No | Cannot be recalled once it has been read | | Local download | No | Depends entirely on the person who took it | ## What the effort actually produces The output of containment is a written inventory, not a claim. For each copy: where it is, who owns it, whether it was removed and when - and, for the ones that were not, a plain statement of the residual exposure with an owner and a review date. That last line is the one people are tempted to omit, and it is the only one that makes the rest credible. Two facts shape how far you can get. - **The value cannot be reissued.** A password or key can be replaced, which retires every copy of it at once. A real name, address or account number stays valid indefinitely, so a copy you cannot reach stays live for as long as it exists. - **The cost scales with the time the value spent unredacted**, because copying happens continuously and quietly in the background. An image found within the hour is a handful of copies; the same image a month later is an unbounded set. ## Escalation The team can decide about copies inside systems it owns. It cannot decide about content that reached people outside the access list, and it should not try. The threshold worth being able to state is this: evidence that stayed within a known access list and was removed quickly is a defect to record and fix; content that left that list, or that cannot be accounted for, goes to whoever owns privacy decisions in the organisation. Where a privacy regime applies there may be notification duties with clocks attached, and those are not an engineer's call to make alone. ## The part everyone skips Once the copies are gone, the write path is still writing the same values into the same channels, and tomorrow's run reproduces the leak exactly. The closing action is the fix: redact the fields shown on that screen at the moment the image is written, add the planted-value check that would have caught it, and - where the real values came from a live dependency - stop them at your own boundary instead. A containment report without that follow-up is a promise to repeat the exercise. A useful test of honesty: read the write-up and ask whether somebody outside the team could tell, from it alone, how many copies still exist. If the answer is *none, because it does not say*, the effort is not finished.