Begin with the support question
A useful support capture should answer a concrete question: which request failed, where the wait occurred, or whether a retry returned a different status. A full account session often contains unrelated requests and private information. Reproduce the issue with the smallest practical workflow and keep the original capture in a private location.
Open the local HAR in the workbench and filter by the failing URL, request method or status group. Filters operate on your local original data. Select the requests needed to show the sequence, including a relevant redirect or dependency, instead of assuming that every recorded request belongs in the support package.
Inspect both structured and hidden locations
Credentials can appear in authentication headers, cookies, URL parameters, submitted forms and response bodies. Browser-specific extension fields, comments, page titles, cache tags and connection identifiers add other places to review. A short list of known secret names cannot discover every arbitrary identifier a service might use.
The default export rebuilds supported fields, aliases domains and paths, removes body content and query data, strips cookie records and retains only a small header subset. If support needs real endpoints or additional headers, choose the appropriate retention mode and inspect its output. Add exact literal replacements for known private values, while remembering that alternate encodings or unrecognized context may still require manual removal.
Share the reviewed result, not the capture
Use the per-request before/after panel to reveal original content only when needed on your own screen. Download the rebuilt HAR and its audit, inspect a representative failed request and confirm that the remaining information is appropriate for the recipient. The redaction ledger records decisions and counts without copying the removed values.
The ZIP contains the rebuilt selection and supporting reports, never a copy of the original input file. That packaging rule prevents an accidental original-file attachment, but does not establish anonymity. If names, paths or JSON keys remain under your chosen policy, review them again before sending the package through an approved support channel.