Do you sanitize production errors before pasting them into Claude Code?

I noticed a small bad habit in my own Claude Code workflow: when something breaks in production, my first reaction is to copy the error and ask Claude Code what is going on.

It feels harmless because it is "just a stack trace." But many logs are not just stack traces. They may contain internal URLs, customer IDs, request payloads, Sentry links, feature flags, file paths, and sometimes even env-like values if the app logs too much.

I'm not saying Claude Code is useless for debugging. It is very useful — especially when it can trace execution flow across a codebase. But I'm starting to treat production errors as untrusted input before I give them to any agent, including terminal sessions, subagents, or MCP-connected tools.

My current rough process is:

• remove IDs, tokens, emails, internal domains
• replace real payloads with fake examples
• describe the app boundary in my own words
• ask Claude Code to reason from the sanitized error, not from the raw log

Maybe this is too cautious, or maybe I was too casual before.

How are you handling this?

• Do you sanitize logs manually before pasting into Claude Code?
• Do you have a template for "safe error reports"?
• Do you trust Sentry exports, browser console output, or MCP tool results as agent input?
• Where do you draw the line between useful debugging context and sensitive production context?

Would love to hear what your workflow looks like.