We see quite a lot of flags like:
Revision 1 contained real credentials
Up to now I've handled these by forwarding them to community managers or developers who have the power to permanently banish revisions from the database.
To be frank this strikes me as a significant waste of effort involving quite a few people and a great example of shutting the stable door after the horse has bolted. I do this currently not because it strikes me as worthwhile, but because it looks like the prevailing community opinion on what to do. I don't think I've seen that discussed anywhere explicitly though.
Personally I think the only course of action worth taking is commenting to point out to the user what they've done, with (optional) community edits. That's something that doesn't need moderator intervention so I am proposing to decline such flags with "should only be used to make moderators aware of content that requires their intervention". My reasoning is:
- The only safe action here is to change the credentials (everywhere they've re-used the same password too).
- Google usually has indexed it by the point we see the flag. Often it's in the data dumps and/or other third party sites.
- Deleting the revision creates a false sense of security for the person who accidentally posted the credentials.
- It serves as an education point for the OP - don't publish private things online, create a MCVE instead.
To be clear: I'm not proposing declining flags in cases where the OP has published PII of third parties1 (which to be frank is criminal stupidity and I'd like to see the culprits held properly accountable for, but that's a different issue).
What does the community think? Is the current process worth it?
1 Yes this really does happen, pretty much the only thing I've not seen is credit card numbers, presumably because banks are more scary than privacy commissioners.