Redacting screenshots: verify by upscaled crop, and hunt secondary exposures

When blacking out PII in a screenshot, do not guess coordinates from the rendered view. Crop the candidate region and upscale it 3x with LANCZOS, view that, then map coordinates back (real_x = crop_x0 + probe_x/scale) — this pins the bounding box within a few pixels and catches off-by-tens errors that leave a digit edge visible. After drawing, re-crop the OUTPUT and view it to confirm coverage; never trust the draw call. Use ImageDraw.rectangle with a solid fill and re-encode (Image.convert(RGB) then save) so the original pixels are destroyed rather than merely covered — blurs and overlay layers are recoverable, composited opaque fills are not, and a PIL save from a converted image drops EXIF by default. Most important habit: the PII the user names is rarely the only exposure. Scan the whole frame for tokenized short links, QR codes, session URLs, and account identifiers — an unguessable-token link rendered legibly in a public screenshot is a working credential, and users routinely miss it because it does not look like a secret.