Found by @BabuBahir while writing tests for #19.
redactPhones("Tracking number: 9400111899223856928490")
// actual: "Tracking number: [PHONE REDACTED]90"
// expected: either fully redacted, or left alone
The phone pattern in lib/utils/pii.ts matches a bounded slice of a 22-digit run and leaves the remaining digits in place. Partial redaction is worse than no redaction, because the output looks sanitised while still exposing part of the original value.
Two defensible fixes, pick one and say which in the PR:
- Require a digit-run boundary so an over-long run is not treated as a phone number at all.
- Consume the whole run when it starts matching, so nothing is left behind.
Done when: the case above no longer leaves trailing digits, a regression test covers it, and the existing tests still pass. Note #19 is adding tests for this file, so coordinate to avoid conflicts.
Comment to claim this. There is a 2-open-claim limit per person so more people get a turn.
Found by @BabuBahir while writing tests for #19.
The phone pattern in
lib/utils/pii.tsmatches a bounded slice of a 22-digit run and leaves the remaining digits in place. Partial redaction is worse than no redaction, because the output looks sanitised while still exposing part of the original value.Two defensible fixes, pick one and say which in the PR:
Done when: the case above no longer leaves trailing digits, a regression test covers it, and the existing tests still pass. Note #19 is adding tests for this file, so coordinate to avoid conflicts.
Comment to claim this. There is a 2-open-claim limit per person so more people get a turn.