1. Never share authentication secrets Do not send passwords, PINs, one-time codes, refresh tokens, API keys, webhook secrets, or private signing keys to support or any other user.
2. Redact business data Remove or mask unnecessary bank data, payment-card data, tax identifiers, identity documents, employee data, customer data, and payroll values before attaching evidence.
3. Preserve tenant boundaries Use the case for the affected tenant and authorized account. Do not attach another organization's information or ask support to bypass roles, permissions, device controls, or multi-factor authentication.
4. Suspected compromise Review device and session history, force logout or ban a device when authorized, and open a protected case with the time and evidence. An error code, trace ID, timestamp, and redacted screenshot are usually enough.