PHONE_PATTERN in lib/utils/pii.ts is loose enough that it matches any run of digits separated by -, . or whitespace once the total digit count reaches MIN_PHONE_DIGITS (7). Because redactPii is applied to every user-submitted text field in app/api/posts/route.ts and app/api/posts/edit/[token]/route.ts, non-phone content gets destroyed on write and there is no way to recover it.
This is not hypothetical. A submission titled
Cloudflare migration smoke test 2026-01-14T13:50:34.240Z
was stored in the registry as
Cloudflare migration smoke test [PHONE REDACTED]T13:50:34.240Z
The ISO 8601 date 2026-01-14 is 8 digits joined by hyphens, so it matches.
Other things that will be eaten the same way, all of which are normal in incident write-ups: version strings such as 1.2.3-4567, CVE identifiers, monetary amounts written with separators, token counts like 8 240 000 000, commit ranges, and case citations.
The file's own comment says the patterns are intentionally conservative and may over-match. That trade-off is defensible for something that looks like a phone number, but a bare date is not one.
What a fix probably looks like:
- Require a phone-shaped structure rather than any digit run, for example a leading
+, a parenthesised area code, or a recognised separator layout, instead of the current fully optional groups.
- Exclude clear non-phone shapes before matching: ISO 8601 dates and timestamps, semver, and 4-digit-year-leading patterns.
- Add cases to
lib/utils/pii.test.ts covering the string above plus each false-positive shape listed here, and keep the existing true positives passing.
Note that #47 fixed a separate defect in the same function; this one is about the match boundary, not the replacement.
If you would like to take this on, comment here to claim it. Contributors can hold two open claims at a time.
PHONE_PATTERNinlib/utils/pii.tsis loose enough that it matches any run of digits separated by-,.or whitespace once the total digit count reachesMIN_PHONE_DIGITS(7). BecauseredactPiiis applied to every user-submitted text field inapp/api/posts/route.tsandapp/api/posts/edit/[token]/route.ts, non-phone content gets destroyed on write and there is no way to recover it.This is not hypothetical. A submission titled
was stored in the registry as
The ISO 8601 date
2026-01-14is 8 digits joined by hyphens, so it matches.Other things that will be eaten the same way, all of which are normal in incident write-ups: version strings such as
1.2.3-4567, CVE identifiers, monetary amounts written with separators, token counts like8 240 000 000, commit ranges, and case citations.The file's own comment says the patterns are intentionally conservative and may over-match. That trade-off is defensible for something that looks like a phone number, but a bare date is not one.
What a fix probably looks like:
+, a parenthesised area code, or a recognised separator layout, instead of the current fully optional groups.lib/utils/pii.test.tscovering the string above plus each false-positive shape listed here, and keep the existing true positives passing.Note that #47 fixed a separate defect in the same function; this one is about the match boundary, not the replacement.
If you would like to take this on, comment here to claim it. Contributors can hold two open claims at a time.