Undisclosed email&name exposure on bug reports

[Wortex17]

It seems that you are posting e-mail addresses, which are required in your bug report form, without any obfuscation here in github issues.
These issues are publicly available without even requiring a github account (not that requiring such an account would be a signficant protection anyway)
At the same time, users are not being made aware of that at all in the bug report form.
Either drop the field, stop exposing them or inform users before submitting the form that this is being done (maybe also drop the requirement r you might miss out on bug reports)

Both Name and Email exposition are a GDPR nightmare.

[codemonkey85]

Thank you for raising this. You are right that the current form does not adequately disclose that the required name and email are copied into a public GitHub issue. We will change this rather than rely on obfuscation.

The implementation plan is:

• remove the name field entirely
• make email optional and require an explicit, unchecked opt-in for follow-up
• never include the email in the public issue, URLs, attachment names, logs, or telemetry
• store opted-in contact details separately in private Azure storage, keyed by issue number and accessible only to the reporting Function/designated maintainers
• delete private contact records 30 days after an issue closes, or 12 months after submission at the latest; deletion requests will be honored sooner
• clearly disclose before submission that the report text, user agent, and technical diagnostics are posted publicly to GitHub
• keep optional save-file attachments private and maintainer-only, with automatic deletion after no more than 30 days, instead of posting a public SAS download link
• send the reporter a confirmation containing the issue link and, when useful, notifications about maintainer responses or closure

Anonymous reports will remain supported; providing contact information will not be required to submit a bug report, feature request, or feedback.

After this implementation has been deployed to the public app, we will perform a separate cleanup of existing issues by removing the current Reporter: lines containing names and email addresses. We will also assess whether GitHub Support is needed for historical issue-body revisions or cached copies, and review application logs for previously recorded email addresses.

This issue will remain open until the new collection, disclosure, private-storage, retention, and attachment behavior is implemented and verified.

[codemonkey85]

Implementation is now ready in #1264.

The PR:

• removes the name field and supports fully anonymous reports
• collects email only behind an explicit, unchecked follow-up opt-in
• never includes contact email in public issues, links, attachment names, responses, or logs
• clearly discloses which report text and diagnostics will be public
• stores opted-in contact records privately by issue number
• keeps save-file attachments private and removes public SAS download links
• removes original filenames from transport headers and public diagnostics
• deletes attachments when an issue closes and enforces maximum retention with Azure lifecycle rules
• moves closed contact records to a 30-day tier while preserving the 12-month overall ceiling
• includes compatibility retention for attachments created by the old issue-number folder scheme

All review threads are resolved, and the official Build and Test workflow, including the full test suite, passed.

One deliberate boundary remains: the current Azure environment has no outbound email-delivery service. The private contact record supports manual maintainer follow-up; automated confirmation/comment/closure emails require a separately selected and configured provider and are not being represented as deployed by this PR.

I am leaving this issue open until #1264 is merged, promoted through UAT, deployed to the public app, and verified. After that I will remove the legacy public Reporter: lines as requested and assess historical issue revisions and Function logs separately.

[codemonkey85]

Production verification is complete after #1265 merged and deployed.

Verified in the public app:

• report submission is anonymous by default, with contact email behind an explicit opt-in
• public issue bodies contain no name or email field
• the contact-enabled test report ([Bug] Something weird happened. #1266) stored its contact record and attachment privately; closing the issue deleted the attachment, moved the contact record to the 30-day closed tier, and wrote the non-sensitive closure marker
• the anonymous test report ([Feedback] This is a really good test of the new feedback privacy. #1267) created neither a contact record nor an attachment; closing it wrote only the non-sensitive closure marker
• both close webhooks returned HTTP 200 and the cleanup operations completed without errors
• the deployed Azure lifecycle policy enforces the intended attachment, contact, and closure-marker retention ceilings

Legacy cleanup is also complete for current issue bodies. I removed the generated Reporter: line from 123 issues, then audited all 620 issue bodies in the repository; none still contains that field. A count-only audit of the retained Application Insights telemetry found no email-like (@) content.

One GitHub-specific follow-up remains: GitHub preserves issue-body edit history. The audit found 124 older revisions across 123 issues that still contain the former reporter field. Those revisions are not removable through the GitHub API; they require per-revision deletion in GitHub's UI or assistance from GitHub Support. I am leaving this issue open until that historical-copy cleanup is resolved.

Automated outbound email remains outside the deployed scope because no mail provider has been selected or configured; opted-in contact details are available privately for manual maintainer follow-up.