From a0f469db6cbacd76e242abb2b8b3db9de71fc919 Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Sun, 11 Oct 2026 19:38:33 +0300 Subject: [PATCH] docs(safety): document inherited safety limitations The safety README now records the known inherited limitations that remain unchanged by the ownership move, covering grouped IBANs, overlapping phone rules, card boundaries, and international phone repetition. The international phone rule comment was also updated to note that its repetition counts separators rather than normalized digits, with the digit bounds tracked as follow-up #263. Auto-committed-on: dragonfly Co-authored-by: Medulla --- crates/tinymemory-api/src/safety/README.md | 11 +++++++++++ crates/tinymemory-api/src/safety/rules.rs | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/crates/tinymemory-api/src/safety/README.md b/crates/tinymemory-api/src/safety/README.md index a486f5e3..1005b6d4 100644 --- a/crates/tinymemory-api/src/safety/README.md +++ b/crates/tinymemory-api/src/safety/README.md @@ -17,3 +17,14 @@ consumers own diagnostics and must consider the sensitivity of derived categorie Risk vocabulary is available by default. Enable `local-safety` for regex-based classification and redaction; the default engine contract stays regex-free. + + +Known inherited limitations remain unchanged by this ownership move: grouped +IBANs can be missed ([260](https://github.com/tinyhumansai/tinymemory/issues/260)), +overlapping phone rules can count one number twice +([261](https://github.com/tinyhumansai/tinymemory/issues/261)), and card boundaries +or an adjacent CVV can produce incomplete matching +([262](https://github.com/tinyhumansai/tinymemory/issues/262)). The international +phone repetition counts separators rather than normalized digits, so seven-digit +numbers can be missed and longer or separator-heavy strings accepted +([263](https://github.com/tinyhumansai/tinymemory/issues/263)). diff --git a/crates/tinymemory-api/src/safety/rules.rs b/crates/tinymemory-api/src/safety/rules.rs index ac39a63b..6cad3122 100644 --- a/crates/tinymemory-api/src/safety/rules.rs +++ b/crates/tinymemory-api/src/safety/rules.rs @@ -141,7 +141,8 @@ fn build_rules() -> Vec { r"\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b", None, ), - // International E.164-ish phone number (leading + and 7–15 digits). + // Legacy international phone-like pattern. Its repetition counts + // separators too; normalized digit bounds remain follow-up #263. pattern_rule(PiiCategory::PhoneNumber, r"\+\d(?:[\d\s\-]{6,16}\d)", None), // IPv4 address (octet-validated). pattern_rule(