Before you publish
Public sharing red‑team checklist
A short, audit‑friendly checklist to prevent IP leakage and avoid misleading compliance claims. Structure‑only; no enabling details.
Rule of thumb
If a page lets a competitor replicate your workflow, you published too much. Keep “how” private; publish “what” and “why”.
IP leakage guardrails
- No schemas, field mappings, or portal templates. Avoid anything that reconstructs your internal data model.
- No step‑by‑step submission instructions. Public pages stay high‑level.
- No thresholds, triggers, or “if X then do Y”. Those are enabling details.
- No example datasets, filled forms, or portal screenshots. Use structure‑only TOCs instead.
Claims & compliance language
Certifications
- Never imply a certification you don’t hold (e.g., ISO 13485).
- Use “aligned to” when you are not certified.
Scope qualifiers
- Use “as applicable”, “structure‑only”, “example”, and “may change”.
- Separate public artifacts from private delivery packs.
Source discipline
- When referencing regulations/standards, link official sources via Standards & References.
- Avoid “law says” language unless you cite the official text.
Numbers & mini‑cases
- Only publish defensible numbers. Include baseline, timeframe, and scope (portfolio size/class/modules).
- Prefer ranges. Label as “example” unless you can stand behind the measurement trail.
- Never publish client‑identifying metrics. No unique timelines, product IDs, or “only‑we‑know” combinations.
If numbers increase reverse‑engineering risk, publish the measurement method and targets — not the result.
Anonymization checks
Content
- Remove names, IDs, internal codes, timestamps, and contact details.
- Replace any real portal/module identifiers with generic labels where possible.
Files & metadata
- Check PDFs for embedded author metadata and tracked changes.
- Ensure manifests/checksums do not reveal private filenames or folder structures.
Release hygiene
Run QA
- Links, i18n keys, canonical URLs, and integrity checks must pass.
Verify integrity
- Generate site manifest + checksums and keep release notes deterministic.
Post‑deploy sanity
- Re‑check key pages after CDN cache invalidation.