IP addresses and URLs in my rules of engagement weren't redacted. Is that expected?

Why this happens

A scan has to know where to look. An address or URL in your rules of engagement is part of the scope, for example a host to avoid. If Cyberlop blanked it out, the instruction would stop working. So the redaction note on the profile form says it directly: IPs and URLs are kept so the scan can use them.

The same note lists what Cyberlop does redact. It finds emails, phone numbers, SSNs and payment cards in the text, and it removes them before analysis.

How to fix it

1. Open the profile and go to Reporting.
2. Read Rules of engagement, Report guidance and the Application context fields.
3. Delete any IP address or URL that you do not want to send to the AI engine. Prefer a description such as "the staging database host".
4. Move any password, key or login out of the text. Use the Authentication section instead, where Cyberlop encrypts and masks secrets.
5. Click Save.

Still not working?

Redaction targets the personal data types above. It does not promise to catch every private detail, such as an internal name or a customer name. Treat the text fields as content you are willing to share with your AI provider.

Cyberlop sends relevant code excerpts to the AI provider you chose, over HTTPS. For the full picture, read how PII redaction works, which types are redacted and the glossary entry on PII. Questions? Use our contact page.

Related questions

• Does Cyberlop redact personal data I type into a profile?
• What kinds of personal data are redacted?
• How do I add rules of engagement, such as no destructive payloads in production?
• How do I steer how the final report is written?
• How do I fill in the Application context for a profile?

Full tutorial

Reporting rules in Cyberlop: severity, confidence, guidance and PII redaction

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre