fix: type columns by whole words, and always redact sensitive identifiers

[fabriziosalmi]

Closes #20 and #21.

What was wrong

Column types were chosen with headerLower.includes(keyword). id is a substring of provider, video_title, width and residence; date of candidate; lat of plate. So ordinary columns were typed wrongly, silently, and consistently.

Two consequences made this more than a tidiness problem:

A misclassified column can pass through untouched. plate_number was typed as a latitude, and fuzzGeoCoordinate returns its input verbatim when it does not parse as a number. Plates were copied into the anonymized output unchanged.

National identifiers were fuzzed as generic text. codice_fiscale, iban, ssn, partita_iva and credit_card matched no rule at all. Fuzzing perturbs a value, so what came out was a recognisable variant of what went in. Through the UI, Mild preset:

codice_fiscale   RSSMRA80A01H501U   ->  RSSMRA80At1V501U
credit_card      4111111111111111   ->  4111111111111111      (unchanged)
credit_card      5500005555555559   ->  5500005555555558      (one digit)

And the "Moderate" preset set every redaction flag to false, making it weaker than "Mild", which redacts identifiers.

What this changes

Whole-word matching. Headers are split into tokens on separators and camelCase boundaries, then matched on tokens and on contiguous token phrases. plate_number is now an identifier, provider is not.

Non-English headers. Italian, Spanish, French and German terms sit alongside the English ones. indirizzo, telefono, data_nascita, importo, codice fiscale and partita iva are exactly the columns most likely to hold personal data in a non-English dataset, and all of them fell through to generic text before.

A sensitive_id category, always redacted. Tax codes, national identity numbers, passports, bank accounts, IBANs, card numbers and security codes. Not a preset default: a hard rule, at every preset and in Custom. There is no fuzz factor at which returning a perturbed tax code is safe, so offering one would be misleading.

IBAN detection by value, with the ISO 13616 mod-97 check, for columns whose header says nothing useful. This is the only value-based sensitive detection here, deliberately: the check digits make false positives essentially impossible, whereas a Luhn check on a bare number would redact one numeric order id in ten.

The presets are a ladder. Each redacts everything the one below it redacts:

	Sensitive identifiers	Identifiers	Free text	Numbers	Dates
Mild	redacted	redacted	light fuzz	light fuzz	±10 days
Moderate	redacted	redacted	redacted	fuzzed	±30 days
Aggressive	redacted	redacted	redacted	redacted	redacted

Mild is unchanged from today. Moderate gains free-text redaction, which is what gives it a defensible position between the other two.

fuzzCSVData is removed. It was a second copy of the anonymization logic that nothing called: the live path is processCSVDataAsync -> processChunk -> anonymizeValue. It had diverged from the live path and logged every original value to the browser console, one line per cell, which is its own problem in a tool whose purpose is not to leak the input. Keeping two implementations is how this kind of defect survives.

Empty cells stay empty instead of becoming REDACTED, so the tool does not invent a value where there was none.

Tests

npm test previously exited 1 with "no test specified". There is now a dependency-free suite, 68 checks, run with plain node:

$ npm test
68/68 checks passed

It is not vacuous: reintroducing substring matching in the rule matcher fails exactly the eight misclassification cases from the report.

script.js now guards its DOMContentLoaded registration with typeof document !== 'undefined' and exports the detection functions when required from Node, which is what makes them testable. Browser behaviour is unchanged.

Verified end to end

Not only in unit tests. The whole app was loaded in a DOM, a CSV uploaded through the file input and the button clicked, for each preset. With the columns nome, codice_fiscale, iban, ssn, partita_iva, credit_card, user_id, plate_number, provider, importo, note:

mild        nome fuzzed, all five identifier columns REDACTED, plate_number REDACTED,
            importo 1250.50 -> 1250.77, empty cell still empty
moderate    everything above plus nome/provider/note REDACTED, importo still fuzzed
aggressive  everything REDACTED

Before this change, the same file under Moderate returned plate_number and credit_card unchanged.

Also in this diff

Two factual errors in the README, small enough to fix in passing and worth naming rather than sneaking in: AGPL-3.0 was described as "permissive" (it is strong copyleft, with obligations for network use), and a <link to your repo if public> placeholder was still in the text. The closing "you can confidently share this file" is now a prompt to check the output first, since typing is heuristic and fuzzed values are perturbations rather than replacements.

Not addressed here

• No consistency map: the same input yields different outputs on different rows, so the output cannot be used as a relational fixture. Deliberate for now, and a separate decision.
• generateRandomName, generateRandomEmail and parseCSV are unused, but were already unused before this change, so they are left for a separate cleanup.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Header camelCase detection is currently broken in the live path due to lowercasing before tokenization, which can prevent intended redaction, and the preset help text has a ladder-direction wording error.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the CSV anonymization pipeline by fixing header-based type detection (whole-word token matching instead of substring matches), introducing an always-redacted sensitive_id category (plus IBAN value validation), and making the preset ladder monotonic in redaction strength, with accompanying documentation and a Node-based test suite.

Changes:

• Replaced substring header matching with token/phrase matching and added sensitive_id handling (always redacted), including IBAN mod-97 validation fallback.
• Fixed preset behavior so Moderate is strictly stronger than Mild, and removed the unused/unsafe duplicate anonymization path.
• Added a dependency-free test suite and updated docs/changelog accordingly.

File summaries

File	Description
script.js	Implements tokenized header detection, sensitive_id handling, IBAN validation, preset ladder fix, removes unused duplicate anonymizer, and exports detection utilities for Node tests.
test/detect-data-type.test.js	Adds unit tests covering tokenization, misclassification regressions, sensitive-id recognition, and IBAN validation.
README.md	Documents column typing rules and preset semantics; updates guidance around sharing outputs and corrects license/link text.
package.json	Updates npm test to run the new Node test file.
index.html	Updates preset help text to explain always-redacted sensitive identifiers and preset ladder behavior.
CHANGELOG.md	Records the fixes/additions/removals introduced by this PR under Unreleased.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.