Handle ethics and data governance as part of the research record, not as a late appendix. This is especially important for platform, community, security, health, education, and other sensitive-domain research.
Read First
references/ethics-data-governance.mdreferences/repository-contract.md
Workflow
- Identify data subjects, platforms, communities, institutions, and affected groups.
- Classify sensitivity: public, restricted, personal, vulnerable, illegal, copyrighted, proprietary, or dual-use.
- Record collection boundaries, access method, terms-of-service risk, consent,
IRB or ethics-board status, and retention policy in
docs/ethics/data-governance.md. - Keep raw sensitive data in ignored local folders unless sharing is approved.
- Prefer aggregate, redacted, or synthetic outputs in reports.
- Add risk notes to dataset pages and claim pages.
- Re-check governance before publishing artifacts, code, or examples.
Red Flags
- personal identifiers in raw or derived files
- screenshots that expose users, handles, addresses, chats, or illegal content
- scraping behind login or against platform restrictions
- model outputs that can reveal memorized sensitive data
- publishing datasets without license or consent analysis
Do Not
- Treat "publicly visible" as automatically safe to redistribute.
- Put credentials, cookies, session exports, or scraped private content in git.
- De-identify by hand without recording the transformation.