diff --git a/README.md b/README.md
index 00b1f4e..c31b81c 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,17 @@ npm test 2>&1 | clipcase add failing-test --source "npm test" --tag failure
 clipcase export failing-test --out handoff.md
 ```
 
+For a reproducible fixture-backed handoff, run:
+
+```sh
+npm run build
+bash demo/run-bug-handoff.sh
+```
+
+The demo captures repro notes and terminal output from
+`examples/bug-handoff`, exports a Markdown handoff, and verifies that
+secret-like input is blocked by default.
+
 For a fuller copy-paste support workflow, see
 [examples/support-handoff-demo.md](examples/support-handoff-demo.md). A short,
 fact-grounded promotion pack lives in
diff --git a/demo/run-bug-handoff.sh b/demo/run-bug-handoff.sh
new file mode 100755
index 0000000..c219c1a
--- /dev/null
+++ b/demo/run-bug-handoff.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+cd "$tmp"
+
+node "$repo_root/dist/src/cli.js" init --storage .clipcase
+node "$repo_root/dist/src/cli.js" new login-redirect --title "Login redirect loop"
+node "$repo_root/dist/src/cli.js" add login-redirect \
+  --source repro \
+  --tag auth,repro \
+  < "$repo_root/examples/bug-handoff/repro.txt"
+node "$repo_root/dist/src/cli.js" add login-redirect \
+  --source "npm test" \
+  --tag failure \
+  < "$repo_root/examples/bug-handoff/terminal.txt"
+
+node "$repo_root/dist/src/cli.js" search redirect | grep -q login-redirect
+node "$repo_root/dist/src/cli.js" export login-redirect --out handoff.md
+grep -q "Login redirect loop" handoff.md
+grep -q "clears expired login cookie" handoff.md
+
+if printf 'token=abcdefghijklmnopqrstuvwxyz123456\n' | node "$repo_root/dist/src/cli.js" add login-redirect 2>"$tmp/secret.err"; then
+  echo "secret-like input was not blocked" >&2
+  exit 1
+fi
+grep -q "Refusing to save" "$tmp/secret.err"
+
+echo "Demo casefile: $tmp/handoff.md"
+
diff --git a/docs/promo/social-hooks.md b/docs/promo/social-hooks.md
index 7cacc66..35b3a6c 100644
--- a/docs/promo/social-hooks.md
+++ b/docs/promo/social-hooks.md
@@ -1,9 +1,10 @@
 # ClipCase Social Hooks
 
-## Positioning
-
 ClipCase is a local-first CLI for turning copied context, terminal output,
-prompts, URLs, and repro notes into Markdown casefiles.
+prompts, URLs, and repro notes into Markdown casefiles. Draft posts should stay
+grounded in current CLI behavior: transparent `.clipcase` storage,
+deterministic Markdown export, offline search, and conservative secret
+blocking.
 
 ## Short hooks
 
@@ -13,6 +14,8 @@ prompts, URLs, and repro notes into Markdown casefiles.
   export one deterministic casefile.
 - Useful agent handoffs are often just the right repro notes plus the right
   terminal output. ClipCase keeps both in plain files.
+- The default safety model is local-first: no watcher, no hosted service, and
+  likely secrets are blocked unless you explicitly allow them.
 
 ## Demo beats
 
@@ -23,6 +26,17 @@ prompts, URLs, and repro notes into Markdown casefiles.
 5. `clipcase export login-redirect --out handoff.md` produces the shareable
    Markdown bundle.
 
+## Fixture-backed demo
+
+```sh
+npm run build
+bash demo/run-bug-handoff.sh
+```
+
+The script creates a temporary case, captures repro and terminal fixtures,
+exports `handoff.md`, verifies key text, and confirms secret-like input is
+blocked.
+
 ## Guardrails
 
 - ClipCase is local-first and does not sync cases.
diff --git a/examples/bug-handoff/repro.txt b/examples/bug-handoff/repro.txt
new file mode 100644
index 0000000..4773245
--- /dev/null
+++ b/examples/bug-handoff/repro.txt
@@ -0,0 +1,14 @@
+Steps to reproduce
+
+1. Open the checkout on a feature branch.
+2. Run npm test.
+3. Observe the failing assertion in the login redirect test.
+
+Observed:
+
+The redirect keeps the expired session cookie and loops back to /login.
+
+Expected:
+
+The redirect clears the expired cookie and lands on /dashboard.
+
diff --git a/examples/bug-handoff/terminal.txt b/examples/bug-handoff/terminal.txt
new file mode 100644
index 0000000..ebd0066
--- /dev/null
+++ b/examples/bug-handoff/terminal.txt
@@ -0,0 +1,8 @@
+$ npm test
+
+not ok 3 - clears expired login cookie before redirect
+  ---
+  expected: "/dashboard"
+  actual: "/login"
+  ...
+