docs: align support docs with public exports

Author: aaronlab

CONTRIBUTING.md

@@ -31,7 +31,7 @@ browser-agent failures instead of speculative APIs.
 ```bash
 uv run --python 3.11 --extra dev pytest -q
 uv build
-python examples/no_api_failure_demo.py
+uv run --python 3.11 python -m browsertrace.cli demo
 browsertrace
 ```
 
@@ -72,4 +72,6 @@ For each PR, include:
 - What user problem it solves.
 - How to try it locally.
 - Test commands run.
-- Screenshots or exported traces for UI/demo changes.
+- Screenshots or exported traces for UI/demo changes. Use
+  `browsertrace export <run_id> --public -o public.html` before attaching a
+  real trace publicly.

SECURITY.md

@@ -32,6 +32,7 @@ Include:
   `BROWSERTRACE_HOME`.
 - HTML exports inline screenshots and model output. Review exports before
   sharing them publicly.
+- Use `browsertrace export <run_id> --public -o public.html` before public
+  sharing to omit prompt/model I/O, screenshots, and URLs.
 - Do not attach trace exports containing secrets, customer data, private URLs,
   cookies, tokens, or proprietary prompts to public issues.
-

SUPPORT.md

@@ -29,6 +29,8 @@ Please include:
 - Agent/browser stack.
 - Reproduction steps.
 - Exported trace or `browsertrace show <id>` output if it is safe to share.
+  Use `browsertrace export <run_id> --public -o public.html` before attaching a
+  real trace publicly.
 
 ## Feature and Integration Requests