URLs are excluded from the PII preset even though they routinely carry reset tokens, user IDs, signed query parameters, and credentials.
Current state
PIIEntity excludes URLEntity (mod.ts:96-115)PIIParsers excludes URL.parser (mod.ts:130-158)- Playground PII preset also excludes URL (
docs/src/registry.ts:69-82)
- URL redaction is only tested via an explicitly selected parser (
tests/redact.test.ts:116-122)
Open design question
Adding URL.parser wholesale would also redact every innocent bare domain. Options:
- Add protocol-qualified URLs only to
PIIParsers (split URL.Full from URL.Bare in the preset)
- Keep
PIIParsers as-is (direct identifiers) and introduce a broader SensitiveParsers preset (URLs, and possibly quasi-identifiers like Location/Institution)
- Both: preset split + documentation of what counts as PII vs quasi-identifier
Tests to add
- Chosen preset redacts
https://example.com/reset?token=...
- It does not redact a bare domain if the policy is full-URL-only
- Public type test confirming which entities belong to each preset
Depends on: url recall issue (authority split makes the full/bare distinction cleaner).
URLs are excluded from the PII preset even though they routinely carry reset tokens, user IDs, signed query parameters, and credentials.
Current state
PIIEntityexcludesURLEntity(mod.ts:96-115)PIIParsersexcludesURL.parser(mod.ts:130-158)docs/src/registry.ts:69-82)tests/redact.test.ts:116-122)Open design question
Adding
URL.parserwholesale would also redact every innocent bare domain. Options:PIIParsers(splitURL.FullfromURL.Barein the preset)PIIParsersas-is (direct identifiers) and introduce a broaderSensitiveParserspreset (URLs, and possibly quasi-identifiers like Location/Institution)Tests to add
https://example.com/reset?token=...Depends on: url recall issue (authority split makes the full/bare distinction cleaner).