You editing the post to remove the sensitive information (e.g. Personally Identifiable Information (PII); security credentials like passwords and access tokens; etc.) and then raising a custom moderator flagging is the appropriate action here. The moderator handling your flag will adjust the content of the revisions prior to the edit where you removed the sensitive information to no longer have the sensitive information you removed. The overall process is called redaction. As the moderator handling your flag completes their proposed redaction of the sensitive information from each earlier revision, another moderator will then review and approve each redacted revision. An internal log is kept of these redactions to prevent abuse.
Because deleted posts are visible by users with the access to moderator tools privilege (i.e. with >10k reputation), moderators will perform redactions of sensitive information from deleted posts when such are flagged.
Overall, the redaction process looks like:
- You should:
- Edit the sensitive information out of the post. The OP may choose to delete the post at this time, as that will further limit the spread of the information until redacted. If you don't edit it out, it remains visible to everyone visiting the page, and your flag then relies on the moderator seeing all of the same sensitive information you do, which will probably happen, but isn't guaranteed.
- Raise an "in need of moderator attention" moderator flag and explain that redaction is needed, if you haven't edited it out, be very clear what you feel needs to be redacted.
- The moderator handling the flag will then
- Separately propose a change (i.e. "redaction") of the sensitive information from each revision prior to your edit. In general, this can be viewed as applying the edit removing the sensitive information to each revision to permanently change each revision.
- A different moderator will review the redaction of each revision of the post and approve the redaction of that revision.
Security information is compromised; OP needs to change it
Once the sensitive information has been posted it is public and should be treated as compromised. Posts on Stack Overflow are routinely archived and/or copied by various sites. There's nothing anyone can do to make that information private again. Redaction will limit the spread of the information, but any access keys (API keys, tokens, etc), security credentials (e.g. usernames, passwords, etc.), etc. should be treated as compromised. All such items which are security concerns should be invalidated and changed.