- Shipped
- November 13, 2026 at 1:39 PM UTC
- Author
- Kamo
- Commit
- e674e35
BRIEF Phase 5 sensitive-data check. DocSensitiveText reads the text a doc already has (PDFBox text layer of the PDF or an Office file's PDF rendition; plain decoding for text/CSV; no OCR, no other engine), bounded (60 MB, 40 pages, 600k chars), cached per dat (content-addressed, never stale), waited on at most 2.5 s on the dry run (a slow first read lands in the cache for the send). Patterns: formatted SSNs with invalid areas/groups excluded, or 9 digits right after SSN/Social Security; account numbers with their label; labelled ABA routing numbers whose checksum holds; IBANs whose mod-97 holds. A hit turns every OUTSIDE cell that would get new access into WARN with plain words ('This document looks like it contains a Social Security number. Make sure this person outside your organization should see it.'), the plan decision into WARN (409 + acknowledgement, as for disclosure warnings), and the row gains sensitive[] + sensitiveNote.