Repository navigation
mask_pii leaves the trailing digits of an international phone number (+90 532 123 45 67 becomes [REDACTED] 67) #1051
Description
Summary
mask_pii leaves the trailing digits of an international phone number in the text: +90 532 123 45 67 becomes [REDACTED] 67. The phone pattern in forgelm/data_audit/_pii_regex.py matches a + country code followed by at most three digit groups of 2-4 digits and a final optional group of up to 4 digits, so a number written in five or more groups is only partly consumed. The remaining digits are still part of a phone number a person could be re-identified from.
Evidence
>>> from forgelm.data_audit import mask_pii
>>> mask_pii("Call +90 532 123 45 67 now")
'Call [REDACTED] 67 now'The user manual's masking example (docs/usermanuals/{en,tr}/data/pii-masking.md) shows the same output and warns that the pattern "does not always consume the full number". The GDPR documentation tells operators that masking removes only the formats it detects; a half-masked phone number is the case where an operator would expect it to work.
Why it matters
forgelm ingest --pii-mask is the only built-in masking step. A corpus masked with it can still contain the last digits of numbers the operator believes are gone, and forgelm audit runs the same pattern, so it does not report them either.
Acceptance criteria
- Numbers written with a
+country code and 2-6 digit groups separated by spaces, dots or hyphens are masked completely. At minimum:+90 532 123 45 67,+1 415 555 0132,+44 20 7946 0958,+49 151 23456789,+33 1 23 45 67 89. - The parenthesised-area-code form
(555) 123-4567keeps working. - No new false positives on timestamps, ISO dates, version strings and log line numbers (the existing phone tests stay green and gain these cases).
- The pattern stays linear: it passes
TestPiiRegexLinearityand the rules indocs/standards/regex.md(bounded quantifiers, no two quantifiers over the same characters). - The "Before / After" example and the warning in
docs/usermanuals/{en,tr}/data/pii-masking.mdare updated to the new behaviour.
Context
Found while correcting the PII-masking documentation for #101. Related: #507 (phone numbers also trip the credit-card detector), #547 (module sweep: dataset audit).
Activity
fix(docs): align GDPR, erasure, retention and PII documentation with …
cemililik commentedon Oct 22, 2026
Triage (2026-10-22): accepted. Medium · Wave 3 · parent #870 (Wave 3 · Module sweep).
Reproduced on
developmentat 735a02f (mask_pii("Call <number> now")):+90 532 123 45 67[REDACTED] 67+90-532-123-45-67[REDACTED]-67+90.532.123.45.67[REDACTED].67+33 1 23 45 67 89+1 415 555 0132,+44 20 7946 0958,+49 151 23456789,(555) 123-4567The French case is worse than the title suggests: the pattern needs 2-4 digits after the country code, so a one-digit area code is never matched. The acceptance criteria already cover it.
Not a duplicate. Related records:
forgelm auditverifies redaction and catches what masking missed, but the audit runs the same regexes with no normalisation and flags none of the 75 leaked… (CR-A11-019) #393 (CR-A11-019) cites the undetected+33number as evidence that the audit cannot verify masking. That finding is about the docs claim and stays open; fixing this pattern removes that one example.+49 15xnumbers are also flagged as 13-digit Visa cards.mask_piiapplies the first matching pattern, so a wider phone pattern can change which category claims a span. Keep 13-digit Visa shape plus Luhn flags ordinary international phone numbers as credit cards and trips the critical PII gate (exit 3) (CR-A11-034) #507's phone-shaped cases in the regression set.Not a security advisory: the residue is already documented in the public manual, and nobody has to attack anything to get it. No newcomer label, because the change needs the regex standard's linearity rules (
docs/standards/regex.md) and the PII regression set.