docs: spell out secret redaction in the bug report proof

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -78,10 +78,9 @@ body:
         <!-- Include the commands (e.g., curl) and their full output, screenshots, or a screen recording demonstrating that the bug happens
              The proof must be completely e2e with no mocks, against a live proxy you ran yourself (e.g., litellm --config config.yaml --detailed_debug on localhost:4000), hitting real LLM provider APIs and costing real $ where the bug involves a provider call. `pytest` commands are not enough
              Show exactly what the end user sees or does, matching the User Flow above step for step
-             Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands
+             Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands. Give env var names with their values redacted, and never paste a real API key, virtual key, or other secret, here or anywhere else in the issue
              If the bug applies to more than one of the LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), include proof for every one of them, not just one
-             For UI bugs: include screenshots and the page URLs you were on
-             Redact API keys and any other secrets before pasting -->
+             For UI bugs: include screenshots and the page URLs you were on. Scrub keys and tokens out of screenshots too, they show up in headers, request panels, and the Admin UI -->
 
     validations:
       required: true