EvidenceVeil v1.0.2

EvidenceVeil v1.0.2

Maintenance release focused on sanitization-bypass hardening.

Fixed

• Fixed a free-text sanitization bypass involving [REDACTED] and [SECRET_REMOVED] markers.
• Sensitive values elsewhere on the same line are now sanitized normally.
• Removed marker-based classifier exclusions that could interfere with reclassification.
• Added regression coverage for mixed marker + email + IP + password + token content.

Compatibility

No vault-format or CLI compatibility break is introduced by this release.

Validation

Validated against the current v1.0.1 baseline with the full automated test, lint, type, dependency, security and package-validation gates before release.

Created and maintained by Taher Amine ELHOUARI
https://www.taheramine.org

EvidenceVeil v1.0.1

EvidenceVeil v1.0.1

Maintenance and integrity release focused on reversible IP pseudonymization correctness and safer restoration behavior.

Fixed

• Resolved a collision defect where distinct public IPv4 addresses could map to the same reversible pseudonym and silently overwrite restoration mappings.
• Added collision-safe deterministic IP pseudonymization with a larger special-use IPv4 output space.
• Added defensive mapping guards so conflicting reversible mappings fail closed instead of silently corrupting restoration data.
• Scoped forward mappings to prevent cross-semantic pseudonym reuse.
• Added deterministic pre-seeding so collision handling remains stable across equivalent datasets.
• Fixed .tar.gz / .tgz detection so compressed tar archives are identified as tar inputs before generic gzip handling.
• Hardened restoration to avoid cascading substitutions during reverse mapping.

Validation

Validated locally on macOS 26.6.2 with Python 3.14.7:

• 50 automated tests passed
• 92.44% branch-aware coverage
• Ruff lint passed
• Ruff formatting passed
• mypy passed
• pip check passed
• pip-audit: no known vulnerable third-party dependencies
• Bandit security scan passed
• Exact Issue #2 regression passed
• 1,000-public-IPv4 stress / round-trip validation passed
• Reversed-order collision determinism validated
• Cross-semantic mapping isolation validated
• Non-cascading restoration regression passed
• Archive detection regression passed
• Wheel and source distribution built successfully
• Twine validation passed for both artifacts

Compatibility

The vault schema remains compatible with valid, non-corrupted v1.0.0 vaults.

Existing v1.0.0 bundles that already suffered an IP pseudonym collision cannot recover an overwritten mapping and should be re-sanitized from the original evidence using v1.0.1.

Credits

Thanks to @yamanin-ninamay for the detailed collision report and for contributing the .tar.gz / .tgz detection fix.

Created and maintained by Taher Amine ELHOUARI

https://www.taheramine.org
https://github.com/MrTaherAmine/evidenceveil

Apache-2.0

EvidenceVeil v1.0.0

EvidenceVeil v1.0.0

Share incident data without exposing the incident.

EvidenceVeil is a local-first privacy engineering and security tool for sanitizing, pseudonymizing, de-identifying, auditing, and packaging cybersecurity evidence before it is shared with vendors, researchers, partners, responders, or other organizations.

Highlights

• Local-first operation with no network dependency required for core processing
• Sensitive-field discovery across common cybersecurity evidence formats
• Policy-driven sanitization and pseudonymization
• Deterministic keyed transformations where appropriate
• Reversible investigation workflows using an encrypted external vault
• Argon2id-based key derivation and ChaCha20-Poly1305 authenticated encryption
• Residual privacy-risk auditing
• Utility assessment and controlled-review decision support
• Evidence integrity verification
• Sanitized evidence bundle generation
• Self-contained HTML reporting
• CSV/TSV, JSON/JSONL, text/log, CEF, LEEF and gzip support
• Archive traversal and unsafe extraction protections
• CSV formula-injection neutralization
• Synthetic demonstration datasets and built-in policies
• CLI-based workflow suitable for analysts, DFIR teams, SOCs, CSIRTs and privacy/security engineers

Validation

The v1.0.0 release candidate was validated locally on macOS with Python 3.14.

Release validation included:

• 44 automated tests passing
• More than 92% branch-aware code coverage
• Ruff static analysis passing
• mypy type checking passing
• pip dependency consistency checks passing
• pip-audit reporting no known third-party dependency vulnerabilities
• Bandit reporting 0 Low, 0 Medium and 0 High issues after reviewed suppressions
• Source evidence immutability verification
• Sanitization and restoration testing
• Encrypted vault compatibility testing
• Bundle verification
• Wheel and source-distribution builds
• Twine package validation

Automated GitHub CI and additional cross-platform validation will be introduced separately and should not be inferred from the local validation above.

Security

EvidenceVeil is designed to reduce disclosure risk, not to make absolute anonymization guarantees.

A successful sanitization run does not automatically mean that a dataset is anonymous, legally anonymized, or appropriate for unrestricted public disclosure. Residual-risk review remains important, especially for unique incident context and free-text evidence.

Encrypted restoration vaults should be stored separately from sanitized evidence packages.

See SECURITY.md and the project documentation for security guidance.

Installation

From the release wheel:

pip install evidenceveil-1.0.0-py3-none-any.whl