From 7653532e89e134206002672ebb545ba6afc6db26 Mon Sep 17 00:00:00 2001
From: mateo <mateo@berri.ai>
Date: Tue, 11 Aug 2026 02:35:44 +0000
Subject: [PATCH] docs: spell out secret redaction in the bug report proof

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/bug_report.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 7b3c9b072d8..cedf04a40d6 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -78,10 +78,9 @@ body:
         <!-- Include the commands (e.g., curl) and their full output, screenshots, or a screen recording demonstrating that the bug happens
              The proof must be completely e2e with no mocks, against a live proxy you ran yourself (e.g., litellm --config config.yaml --detailed_debug on localhost:4000), hitting real LLM provider APIs and costing real $ where the bug involves a provider call. `pytest` commands are not enough
              Show exactly what the end user sees or does, matching the User Flow above step for step
-             Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands
+             Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands. Give env var names with their values redacted, and never paste a real API key, virtual key, or other secret, here or anywhere else in the issue
              If the bug applies to more than one of the LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), include proof for every one of them, not just one
-             For UI bugs: include screenshots and the page URLs you were on
-             Redact API keys and any other secrets before pasting -->
+             For UI bugs: include screenshots and the page URLs you were on. Scrub keys and tokens out of screenshots too, they show up in headers, request panels, and the Admin UI -->
 
     validations:
       required: true