After an authorized city guest-Wi-Fi assessment recovers a weak PSK, an intern wants to paste the passphrase into a public Discord channel for 'study notes.' What is the correct handling?

After an authorized city guest-Wi-Fi assessment recovers a weak PSK, recovered credentials are sensitive engagement data and must be reported only to the authorized client through agreed channels—not pasted into public Discord, social media, or unrelated group chats. Civic professionalism and often law or policy forbid uncontrolled disclosure even when the passphrase was weak. Teaching restraint is part of OSWP-aligned assessment culture.

'Publish the PSK immediately so neighboring cities can harden identical SSIDs' fails because publishing the PSK so neighboring cities can harden identical SSIDs expands harm and violates engagement confidentiality. 'Post only the first eight characters so the channel remains educational' fails because posting the first eight characters is still unauthorized disclosure of sensitive credential material. 'Upload the handshake file publicly and keep the passphrase private' fails because uploading the handshake publicly while keeping the passphrase private still leaks client cryptographic material.

Exam caveat: weak secrets deserve strong findings language, not public shaming dumps that expand harm. Operational check: place the recovered municipal PSK only in the secured report package, redact from chat tools, follow retention rules, and brief interns on disclosure boundaries before the next engagement. Verify tickets and screenshots do not leak into public repos. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.