Removing URLs and Emails: A 15-Token Privacy Scrub Test
Fixture-backed URL and email removal with false-positive and false-negative cases. Convenience cleanup only—not redaction or compliance tooling.
- Question
- Which URL and email patterns does the shared remover catch, and which identifiers still leak through?
- Samples
- 15 fixtures
- Generated via core
- 14
- Manual / limits
- 1
- Published
- Modified
- Author
- Dionis Ceban
- Method
- Fifteen tokens/sentences run through removeUrls and/or removeEmails in the shared core. Observation fixtures document limits. No claim of anonymization, GDPR tooling, or security guarantees.
Why this test matters
People paste chat logs and tickets before sharing. Automated scrubbing helps, but phones, names, IDs, and scheme-less hosts often remain.
Tools under test
Result summary
14 of 15 fixtures were executed through assets/js/tools-src/core.js. 1 entries are labeled manual review or limitation without inventing a transform result.
Full test matrix (15 samples)
| ID | Case | Input | Operation | Observed | Status |
|---|---|---|---|---|---|
| priv-https-01 | https URL with query | See https://example.com/report?user=7 for details. |
removeUrls | See for details. |
Pass |
| priv-www-02 | www URL without scheme | Visit www.example.org/path today. |
removeUrls | Visit today. |
Pass |
| priv-punct-03 | URL with trailing punctuation | Link (https://example.com/a). |
removeUrls | Link ( |
Pass |
| priv-subdomain-04 | Subdomain URL | Host https://api.shop.example.com/v1/items |
removeUrls | Host |
Pass |
| priv-email-alias-05 | Email with plus alias | Contact name+sales@example.co.uk please. |
removeEmails | Contact please. |
Pass |
| priv-email-case-06 | Mixed-case email | Write to Admin.User@Example.COM now. |
removeEmails | Write to now. |
Pass |
| priv-both-07 | URL then email | https://example.com and a@b.co |
removeUrls → removeEmails | and |
Pass |
| priv-noscheme-08 | Domain-like text without scheme | Server example.com is listed. |
removeUrls | Server example.com is listed. |
Pass |
| priv-phone-09 | Phone number remains | Call +1-415-555-0133 tomorrow. |
removeUrls → removeEmails | Call +1-415-555-0133 tomorrow. |
Pass |
| priv-username-10 | Username @handle remains | Follow @marketing for updates. |
Observation (no auto transform) | @marketing is not an email; removeEmails should not treat social handles as addresses. Verify on your build. | Limitation |
| priv-name-id-11 | Name and account ID remain | Jordan Lee · account 73921 |
removeUrls → removeEmails | Jordan Lee · account 73921 |
Pass |
| priv-intl-email-12 | Email on country-code TLD | team@example.com.au |
removeEmails | |
Pass |
| priv-fp-noturl-13 | False positive check: version-looking text | Build v1.2.3 released. |
removeUrls | Build v1.2.3 released. |
Pass |
| priv-fn-mailto-14 | mailto: link style | mailto:help@example.com |
removeEmails | |
Pass |
| priv-http-15 | http scheme | http://example.com/old |
removeUrls | |
Pass |
Edge cases and failures
Scheme-less example.com, phone numbers, account IDs, and @handles are the main miss classes observed in this corpus.
Conclusion
Use URL/email removal as a first pass, then search for @, http, www, phone patterns, and IDs. This is convenience cleanup—not comprehensive redaction.
Limitations
- Not a substitute for legal redaction, DLP, or compliance workflows.
- Internationalized domain handling is limited to what the shared regex/core supports.
- False negatives for scheme-less hostnames are expected.
Reproducibility
Download privacy-tokens.txt and fixtures.json. Re-run npm run guides:evidence. Compare to expected-results.json (15 samples).
Downloadable evidence
- Fixture corpus (JSON) (4.3 KB)
- Observed results (JSON) (5.0 KB)
- privacy-tokens.txt (476 B)