How to Remove Sensitive Data from JSON and API Responses

Search for confirmation target by key name

Typical items to be checked are apiKey, accessToken, secret, password, cookie, email, phone, and address. However, since there are unique abbreviations and Japanese keys, you cannot rely on automatic determination based on the key name alone.

Even seemingly safe values like requestId or timestamp can become identifiers that can be matched against internal logs. Replace it if it is not needed for sharing purposes.

Steps to safely process JSON

1. Separate HTTP headers and cookies and copy only the response body for sharing.
2. Verify credentials, personal information, and internal identifiers as both keys and values.
3. Replace strings with safe sample values and numbers with placeholders that preserve their digit count. Keep null and Boolean values when they are needed to test behavior.
4. Check that it can be parsed as JSON after formatting and that no actual data remains in the second half of the array.

Why Data Types Should Be Preserved

Pay attention not only to the JSON itself, but also to the URL, developer tools header, and file name that appear in the screenshot.

Specific example: Sharing the response of the order API

An order API may contain personal information not only in obvious fields such as customerId, email, address, and accessToken, but also in free-text fields and nested arrays.

If you convert a number to a string, you will not be able to reproduce the type-dependent bug. Numeric values are treated as numbers, boolean values are treated as boolean values, and the positional relationship between keys and arrays is maintained.

1. First check that it can be parsed as well-formed JSON.
2. Check the authentication, customer, address, order, and metadata layers in sequence.
3. Select and mask keys, strings, and numbers.
4. Even when you right-click on a result to partially release it, only the values that are allowed to be made public are limited.

JWT may contain user information inside even if it is a string separated by periods. Replace the entire token, not just the middle.

Frequently asked questions

Should I also mask the JSON key name?

You can leave the general key of the public API, but if it contains internal business names, customer-specific items, or unpublished function names, the key will also be included.

Do I also need to hide null, true and false?

These values are usually not sensitive and help reproduce processing conditions, so leave them unchanged. However, if the presence of an attribute is itself sensitive, consider removing the entire field.