Start with permission and policy
Before you publish a screenshot, narrative, data sample, repository, or downloadable file, review the agreements and policies that apply to the work. An NDA, employment agreement, client policy, or internal security rule may restrict what can be shared even when the project is no longer active. Ask for written permission when that is appropriate, and get qualified legal or contractual advice for questions that depend on your obligations.
Remove identifiers before you tell the story
- Company, client, employee, customer, supplier, and partner names.
- Email addresses, phone numbers, account IDs, tickets, invoice references, and user access details.
- Sensitive commercial metrics, source exports, unique dates, locations, and combinations of details that make an organization easy to infer.
- Browser tabs, notifications, file paths, document properties, image metadata, and screen recordings that reveal more than the main content.
- Credentials, API keys, connection strings, tokens, secrets in source code, and repository history that still contains them.
Redaction is more than covering a logo. Review the surrounding context. A dashboard can disclose its organization through a unique metric, a filter value, a URL, a report title, or a side-panel notification even after names are removed.
Use a safer representation when the original cannot be shown
| Approach | What it can preserve | What to disclose |
|---|---|---|
| Synthetic data | Modeling, calculations, interactions, and the shape of a workflow. | That the data is synthetic and does not represent the original organization. |
| Normalized or scaled values | Relative trends and visual design without revealing exact values. | That values were changed and why the transformation was needed. |
| Composite or fictional scenario | A pattern drawn from several safe-to-describe constraints. | That the scenario is fictionalized or composite, not a named engagement. |
| Rebuilt visual | Information hierarchy and interaction without reusing a confidential artifact. | That the visual was reconstructed from scratch for portfolio use. |
The goal is not to make a fictionalized piece look like a client case study. Label it honestly. A clear explanation of your role, methods, constraints, and what was changed is more credible than an unnamed story that implies private access.
Choose publication and access controls deliberately
A public page, an unlisted URL, a noindex page, password protection, and private hosting solve different problems. Use the access level that matches the sensitivity of the material. If the work should not be disclosed to the public, do not rely on a search directive as the primary control.
| Method | What it does | What it does not do |
|---|---|---|
| Public page | Makes the work broadly shareable and indexable when search is allowed. | Protect confidential content. |
| Unlisted URL | Reduces casual discovery when a link is shared selectively. | Authenticate a viewer or prevent someone with the URL from sharing it. |
| Noindex | Asks supporting search engines not to index a crawlable page. | Make the page private or prevent direct access. |
| Password protection or private hosting | Requires access before the content is delivered. | Replace a review of whether the viewer should receive the material at all. |
Review files and repositories separately
A downloadable artifact can carry more risk than the page that links to it. Inspect file properties, embedded data, comments, revision history, hidden sheets, metadata, images, and exported source. For repositories, inspect commit history, deleted files, environment examples, package lockfiles, issue links, and deployment configuration. Remove or rotate exposed secrets through the right operational process rather than assuming a visual edit has fixed history.
Pre-publication review checklist
- Confirm you have permission or a sound basis to share every visible element.
- Remove names, identifiers, confidential metrics, access details, and indirect clues.
- Disclose synthetic, normalized, composite, or rebuilt elements clearly.
- Review files, screenshots, recordings, source history, and metadata separately.
- Choose public, unlisted, password-protected, or private delivery based on sensitivity.
- If a project cannot be represented safely, describe the capability at a high level or leave it out.
Sources
- Block Search indexing with noindex
Google Search Central · Accessed August 5, 2026. Used to support the explanation that noindex is an indexing directive which requires crawler access, not authentication or private hosting.