Make report attachment and diagnostics guidance safe

Report entry still treated sanitized exports as sufficient and named an obsolete Diagnostics action. Warn before live collection during backups or an unresponsive host, reuse displayed results, and require local privacy review of files, screenshots and echoed errors without adding intake requirements.

Contract-Neutral: Community intake guidance only; release, installation and diagnostic runtime contracts are unchanged.
Change-source: pulse-maintainer

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -9,9 +9,11 @@ body:
       value: |
         Report the version on the running instance where the bug occurs, not just the version you upgraded from. If installation failed before Pulse could start, give the exact version you tried to install, or write "unknown" and identify the installer or helper below. For container installs, include the running image tag or digest; for other installs, leave the image field blank.
 
-        If repeating the action could cause data loss, an outage, duplicate changes, or excessive notifications, do not repeat it just to fill in this form. Describe the original sequence and what you observed instead. If Pulse is running and it is safe to do so, connection- or data-related reports can include diagnostics from `Settings -> Diagnostics -> Export for GitHub (sanitized)`.
+        If repeating the action could cause data loss, an outage, duplicate changes, or excessive notifications, do not repeat it just to fill in this form. Describe the original sequence and what you observed instead.
 
-        Do not post secrets, tokens, private keys, or unsanitized configuration files.
+        For connection or data failures, only collect diagnostics if Pulse is running and collection is safe. **Run Diagnostics** can make live API and guest-agent requests; do not run it during backups, freeze/thaw or an unresponsive-host incident just to file a report. Prefer existing observations; if a result is already displayed, its GitHub export downloads that result without running checks again. See [safe diagnostics collection](https://github.com/rcourtman/Pulse/blob/main/docs/TROUBLESHOOTING.md#collect-diagnostics-safely).
+
+        Anything you attach here is public. Review files and screenshots locally before posting, even when an export is labelled "sanitized". Remove credentials, session cookies, secret URLs, private host/network and personal details, including text echoed in errors. Do not attach full/private diagnostics, .env or configuration files, private keys, Copy as cURL commands or full network exports.
 
   - type: textarea
     id: bug_description
@@ -105,7 +107,9 @@ body:
     id: logs
     attributes:
       label: Logs, screenshots, or diagnostics
-      description: Add relevant logs or sanitized diagnostics for connection and data failures; for visual failures, attach a screenshot or quote the exact error. Redact secrets.
+      description: |
+        Add relevant redacted logs or a reviewed GitHub diagnostics export for connection and data failures; for visual failures, a screenshot or exact error may be enough. Prefer existing evidence when new collection is unsafe.
+        Review files and screenshots locally; remove secrets and identifying details, including those echoed in errors, before attaching them here.
     validations:
       required: false
 

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -9,7 +9,7 @@ body:
       value: |
         Lead with one primary operator outcome. If context exposes another actionable topic, list it in the dedicated field below; triage will preserve it rather than silently folding it into the primary request.
 
-        Do not include credentials, tokens, private keys, or unsanitized configuration files.
+        Anything you attach here is public. Review files and screenshots locally before posting, even when an export is labelled "sanitized". Remove credentials, session cookies, secret URLs, private host/network and personal details, including text echoed in errors. Do not attach full/private diagnostics, .env or configuration files, private keys, Copy as cURL commands or full network exports.
 
   - type: textarea
     id: problem
@@ -54,7 +54,9 @@ body:
     id: additional_context
     attributes:
       label: Additional context
-      description: Add screenshots, examples, or related issues. Do not include credentials, tokens, private keys, or unsanitized configuration files.
+      description: |
+        Add screenshots, examples, or related issues if useful.
+        Review files and screenshots locally; remove secrets and identifying details, including those echoed in errors, before attaching them here.
 
   - type: checkboxes
     id: confirmations

.github/ISSUE_TEMPLATE/v6_rc_feedback.yml

@@ -8,9 +8,11 @@ body:
         Use this form for actionable Pulse v6 pre-release feedback.
 
         For general impressions or smaller notes, use the pinned v6 pre-release feedback hub.
-        Give the version on the affected running instance, or the version or release asset attempted if installation never completed. For a running container (Docker, Compose, or Kubernetes), include the Pulse image tag or digest; non-container installs do not need an image reference. Include sanitized evidence where available. Do not repeat an action just to fill in this form if it could cause data loss, an outage, duplicate changes, or excessive notifications; describe the original sequence instead.
+        Give the version on the affected running instance, or the version or release asset attempted if installation never completed. For a running container (Docker, Compose, or Kubernetes), include the Pulse image tag or digest; non-container installs do not need an image reference. Do not repeat an action just to fill in this form if it could cause data loss, an outage, duplicate changes, or excessive notifications; describe the original sequence instead.
 
-        Do not post secrets, tokens, private keys, or unsanitized config files.
+        For connection or data failures, only collect diagnostics if Pulse is running and collection is safe. **Run Diagnostics** can make live API and guest-agent requests; do not run it during backups, freeze/thaw or an unresponsive-host incident just to file a report. Prefer existing observations; if a result is already displayed, its GitHub export downloads that result without running checks again. See [safe diagnostics collection](https://github.com/rcourtman/Pulse/blob/main/docs/TROUBLESHOOTING.md#collect-diagnostics-safely).
+
+        Anything you attach here is public. Review files and screenshots locally before posting, even when an export is labelled "sanitized". Remove credentials, session cookies, secret URLs, private host/network and personal details, including text echoed in errors. Do not attach full/private diagnostics, .env or configuration files, private keys, Copy as cURL commands or full network exports.
 
   - type: dropdown
     id: feedback_type
@@ -145,7 +147,9 @@ body:
     id: evidence
     attributes:
       label: Logs, screenshots, or diagnostics
-      description: Attach screenshots or paste relevant redacted logs. For connection or data failures, include sanitized diagnostics if Pulse is running and it is safe to collect them. Do not include credentials.
+      description: |
+        Attach screenshots or paste relevant redacted logs if useful. For connection or data failures, a reviewed GitHub diagnostics export can help; prefer existing evidence when new collection is unsafe.
+        Review files and screenshots locally; remove secrets and identifying details, including those echoed in errors, before attaching them here.
 
   - type: checkboxes
     id: confirmations

.github/scripts/issue-version-triage.test.cjs

@@ -299,6 +299,40 @@ test("pre-release evidence keeps screenshots visible and asks only running conta
   assert.doesNotMatch(evidenceField, /render:/);
 });
 
+for (const name of ["bug_report.yml", "v6_rc_feedback.yml"]) {
+  test(`report intake collection safety: ${name}`, () => {
+    const form = fs.readFileSync(path.resolve(__dirname, "../ISSUE_TEMPLATE", name), "utf8");
+    const introduction = form.split("  - type: markdown\n")[1].split("  - type: ")[0];
+    assert.match(introduction, /Run Diagnostics.*live API and guest-agent requests/);
+    assert.match(introduction, /do not run it during backups, freeze\/thaw or an unresponsive-host incident/);
+    assert.match(introduction, /Prefer existing observations/);
+    assert.match(introduction, /downloads that result without running checks again/);
+    assert.match(introduction, /docs\/TROUBLESHOOTING\.md#collect-diagnostics-safely/);
+    assert.doesNotMatch(introduction, /Export for GitHub \(sanitized\)/);
+  });
+}
+
+for (const [name, field] of [
+  ["bug_report.yml", "logs"],
+  ["v6_rc_feedback.yml", "evidence"],
+  ["feature_request.yml", "additional_context"],
+]) {
+  test(`report intake privacy at attachment point: ${name}`, () => {
+    const form = fs.readFileSync(path.resolve(__dirname, "../ISSUE_TEMPLATE", name), "utf8");
+    const introduction = form.split("  - type: markdown\n")[1].split("  - type: ")[0];
+    const attachment = form.split(`    id: ${field}\n`)[1].split("  - type: ")[0];
+    assert.match(introduction, /Anything you attach here is public/);
+    assert.match(introduction, /even when an export is labelled "sanitized"/);
+    for (const sensitive of ["session cookies", "secret URLs", "private host", "personal details", "errors", ".env", "private keys", "Copy as cURL", "full network exports"]) {
+      assert.ok(introduction.includes(sensitive), `${name} must warn about ${sensitive}`);
+    }
+    assert.match(attachment, /Review files and screenshots locally/);
+    assert.match(attachment, /identifying details.*errors/);
+    assert.doesNotMatch(attachment, /render:/);
+    assert.doesNotMatch(attachment, /required: true/);
+  });
+}
+
 test("older-version reports cannot trigger event or scheduled retest posting", async () => {
   const issue = {
     number: 1200,