Documents contain vast amounts of invisible metadata. When releasing documents publicly, failure to scrub this data is a severe security vulnerability.
Hidden Payloads
- EXIF Data: Images embedded in PDFs often retain GPS coordinates, camera models, and timestamps.
- Revision History: DOCX and PDF formats can store 'fast save' histories or tracked changes, allowing end-users to recover deleted text.
- XMP / Document Info: Author names, internal network paths, and creation dates are standard in PDF metadata dictionaries.
Sanitization Protocols
A true sanitization engine does not just delete the XMP dictionary. It must parse every embedded object, strip EXIF from raster images, flatten annotations, and rewrite the cross-reference table to ensure deleted data is physically removed from the byte stream, not just unlinked.