When updating or writing documentation for a tool, never include real data that was provided in prompts, local configuration, scripts, task files, or any other implementation-specific source. Documentation must use only generic, commonly recognized placeholder data that cannot expose sensitive information.
A tool's source code and local configuration often contain real names, real email addresses, real organization details, and real domain names. These values are necessary for the tool to function, but they have no place in public-facing documentation. Leaking real data into docs can expose:
If data came from a prompt, a local file, a script, a config, or a task — it does NOT go into documentation.
Documentation examples use only well-known, fictional, or obviously placeholder data.
Any value that originates from:
config.json, .env, account modules)Use these generic, cliche substitutes in all documentation and examples:
CategoryApproved Placeholder ExamplesPeopleJane Doe, John Smith, Alice, BobEmail addressesjane.doe@example.com, admin@example.orgOrganizationsAcme Corp, Contoso, Northwind TradersDomainsexample.com, example.org, test.localAddresses123 Main Street, Suite 100, SpringfieldPhone numbers(555) 123-4567Accounts / usernamesdemo-user, test-accountFile pathsaccounts/acme.mjs, config/reports.jsonProject namesMy Project, Sample App, Demo Tool
A placeholder is only correct if it is plausible in the surrounding context. A generic name that violates OS conventions, tooling norms, or the workflow being described is just as misleading as a real value. Pick substitutes that fit the platform, the tool, and the role the value plays.
OS / contextUseAvoidWindows, per-user dataC:\Users\<user>\AppData\Local\AcmeApp\``/home/user/..., ~/.config/...Windows, per-machine shared dataC:\ProgramData\AcmeApp\``C:\Users\<user>\...Windows, temporary%TEMP%\acme\ or C:\Users\<user>\AppData\Local\Temp\acme\``/tmp/acme/POSIX, per-user data~/.config/acme/, ~/.local/share/acme/``C:\Users\<user>\...POSIX, temporary/tmp/acme/``%TEMP%\acme\Cross-platform examplesShow both, or use <config-dir>/acme/Picking one silently
When the surrounding text or code is OS-specific (a .bat file, a .jsx running on Windows, a bash snippet), the path placeholder must match that OS. When the docs are platform-neutral, either show both forms or use a clearly abstract token ( <install-dir>, <config-dir>).
The placeholder must sit in a location that makes sense for the kind of data it represents:
Data rolePlausible placeholder locationPer-user logs and runtime outputUser-profile folder ( C:\Users\<user>\AppData\Local\<App>\logs\, ~/.local/state/<app>/)Per-user settingsUser config folder ( %APPDATA%\<App>\, ~/.config/<app>/)Machine-wide shared stateC:\ProgramData\<App>\, /var/lib/<app>/Project-local working filesRepository-relative paths ( ./build/, ./tmp/)Generated output artifactsProject output folder ( ./dist/, ./out/)
A user-driven script that writes a debug log should not place that log in C:\ProgramData\… (machine-shared); a service that maintains shared state should not place it in ~/.config/… (per-user). Pick the location a real implementation of that role would pick.
When the example uses an identifier (account name, project name, dataset key), choose a placeholder consistent with the surrounding domain vocabulary.
acme-corp, northwind-traders.springfield, region-west.demo-app, sample-project.Do not mix domains ( acme-corp inside a geographic-data example reads as wrong even though both names are approved generically).
Before committing a placeholder, ask:
If any answer is no, swap the placeholder for one that fits.
If you add a feature using real account data (e.g., a script named after a real client), document the feature using a fictional account name instead.
Real implementation file: an account module configured for a specific business
Documentation example:
javascript
// accounts/acme.mjs — Example account configuration
export default {
name: 'Acme Corp',
email: 'reports@example.com',
folder: 'INBOX',
};
If a config file references real domains, real paths, or real credentials, replace every real value with a placeholder before including it in documentation.
Documentation example:
json
{
"host": "imap.example.com",
"user": "admin@example.com",
"folder": "INBOX/Reports",
"outputDir": "./downloads"
}
If a script automates a task for a specific organization, the documentation example must use a generic organization name and generic parameters.
Documentation example:
batch
@echo off
REM Example: Run the extraction task for Acme Corp
node extractEmail.mjs --account acme --task download
ContextReal Data Allowed?Local scripts and config files used at runtimeYesGit-ignored files with environment-specific valuesYesPrompt data provided to build or configure the toolYes (in code only)README.md, docs/ folder, and example templatesNo — use placeholders onlyCHANGELOG.md entriesNo — describe changes genericallyCode comments in committed source filesNo — keep generic
A word from real data may appear in documentation only if it is a common English word used in its ordinary sense and not in the context of an example. For instance, the word "development" is acceptable in a sentence like "This tool is under active development" even if it also appears in a real organization name.
Documentation is public. Implementation data is private. Keep them separate. Every example in every doc file should pass a simple test: could a stranger read this and learn nothing about the real users, clients, or organizations behind this tool? If the answer is no, replace the data with cliche placeholders.