On this page
Never share a raw Clash configuration directly; create a separate troubleshooting copy first
A complete YAML file, log, or screenshot often exposes a subscription token, node passwords, a controller secret, and internal addresses together. Keep the original recovery backup in encrypted storage you control. For troubleshooting, build a minimal copy from a blank file instead of casually hiding a few fields in the original.
Check each item before sharing
| Location or field | What it may expose | How to handle it |
|---|---|---|
| Subscription URL query parameters | A token that can retrieve the entire configuration | Remove the complete URL; retain only the domain and status code |
| proxies entries | server、UUID、password、PSK、private-key | Use example.com and REDACTED placeholders |
| external-controller / secret | Local controller address and API key | Preserve the field structure and replace the real values |
| Logs and screenshots | Authorization, Cookie, username, and QR code | Crop unrelated interface areas and read everything again |
| LAN and corporate domains | Internal addresses, hostnames, and topology | Keep only the smallest scope required to show the issue |
Keep complete backups separate from support attachments from the start
A complete backup is for recovery and must retain real subscriptions, nodes, and local overrides, so it belongs only in encrypted storage you control. A troubleshooting copy is for someone else to read; start with a new file and include only fields needed to reproduce the issue. Do not whittle down the original, because long URL values, Provider header values, and script parameters are easy to miss.
A backup filename can include the client, core, and date, such as verge-macos-2026-07-16-private.zip. An archive is not encrypted. If you store it in the cloud, use the platform's end-to-end encryption or an encrypted archive, and restrict sharing permissions.
Use placeholders to create a minimal configuration whose structure remains understandable
mixed-port: 7890
external-controller: 127.0.0.1:9090
secret: REDACTED
proxies:
- name: test-node
type: socks5
server: example.com
port: 1080
username: REDACTED
password: REDACTED
proxy-groups:
- name: Test
type: select
proxies: [test-node, DIRECT]
rules:
- DOMAIN,example.org,Test
- MATCH,DIRECTIf the problem involves DNS, retain only DNS, one test policy group, and the relevant rules. If it is a YAML parsing problem, retain the hierarchy surrounding the failing line. After substituting placeholders, verify locally that the same error still occurs; otherwise, the shared file no longer demonstrates the original issue.
Perform one final manual check with text search before sending
rg -n -i 'token|secret|password|passwd|uuid|private-key|authorization|cookie' .
git diff --staged
git log --all -- path/to/config.yamlSearch can flag common fields, but it cannot identify custom header values, QR codes, or renamed credentials. After reviewing search results, still read every line you plan to share, and inspect terminal prompts, browser tabs, and screenshot notifications.
If the real configuration has already been sent, rotate credentials instead of continuing to redact it
If the original file has already appeared in a group chat, support ticket, or public repository, sending a redacted version can reduce later misuse but cannot invalidate the old credentials. The next step is rotation, not further editing of the leaked file.
| Exposed content | Immediate action |
|---|---|
| Complete subscription URL | Reset the token/subscription address in the service panel, then update every device |
| external-controller secret | Generate a new secret and confirm that the controller port is not exposed to untrusted networks |
| Node authentication credentials | Have the server administrator replace the password, UUID, PSK, or private key |
| Git history | Rewrite history and rotate every credential; deleting only the latest file is not enough |
| Public log or screenshot | Retract it to reduce distribution, then rotate each real credential it exposed |
After rotating, access the old subscription address from a signed-out window or call the controller interface with the old secret to confirm that it truly no longer works. Renaming the client entry or deleting the public post does not replace this verification.
Final-page check before sending an attachment
The smaller a troubleshooting attachment is, the easier it is for others to understand and the less likely you are to miss a credential. Read it one last time before sending and confirm that the file serves only the current issue.
Conditions for sending
- The minimal copy still reproduces the same error locally
- All URL query parameters, node authentication values, and secret values have been replaced
- The log contains no Authorization, Cookie, local username, or absolute path
- The screenshot contains no QR code, account details, notifications, or unrelated tabs
- The original complete backup has never entered a public repository or shared link