A computer-implemented method comprising: determining that a first electronic communication, received in a first private repository of a user, has been flagged by the user as including a threat; determining a probability that the first electronic communication includes the threat; in response to determining that the probability exceeds a threshold probability, monitoring for a second electronic communication, received in a second private repository, that includes contents that match the contents of the first electronic communication; and in response to, based on the monitoring, identification of the second electronic communication: generating a copy of the second electronic communication to an administrative private repository of an administrator; editing the copy to remove a portion that is likely to include the threat by: scanning the copy for a payload corresponding to the threat; and deleting the payload detected during the scanning from the copy; inserting the copy of the second electronic communication to the second private repository by causing an application programming interface that administrates the second private repository to insert the copy in the second private repository where the second electronic communication was found, so as to replace the second electronic communication; and deleting the second electronic communication from the second private repository. determining that a first electronic communication, received in a first private repository of a user, has been flagged by the user as including a threat; determining a probability that the first electronic communication includes the threat; in response to determining that the probability exceeds a threshold probability, monitoring for a second electronic communication, received in a second private repository, that includes contents that match the contents of the first electronic communication; and in response to, based on the monitoring, identification of the second electronic communication: generating a copy of the second electronic communication to an administrative private repository of an administrator; editing the copy to remove a portion that is likely to include the threat by: scanning the copy for a payload corresponding to the threat; and deleting the payload detected during the scanning from the copy; inserting the copy of the second electronic communication to the second private repository by causing an application programming interface that administrates the second private repository to insert the copy in the second private repository where the second electronic communication was found, so as to replace the second electronic communication; and deleting the second electronic communication from the second private repository. generating a copy of the second electronic communication to an administrative private repository of an administrator; editing the copy to remove a portion that is likely to include the threat by: scanning the copy for a payload corresponding to the threat; and deleting the payload detected during the scanning from the copy; scanning the copy for a payload corresponding to the threat; and deleting the payload detected during the scanning from the copy; inserting the copy of the second electronic communication to the second private repository by causing an application programming interface that administrates the second private repository to insert the copy in the second private repository where the second electronic communication was found, so as to replace the second electronic communication; and deleting the second electronic communication from the second private repository.