Automatic sanitization

Pinar redacts password, payment, token, and OTP fields; removes URL fragments; and strips known sensitive query keys such as access_token, api_key, auth, password, secret, token, and jwt. You can add more query-key names in extension settings.

The visual-context parser accepts supported schema versions and redacts internal parse errors rather than exposing raw secrets. Inline screenshot data is removed from text handoffs; the bundle uses a bounded path or URL reference instead.

Pinar redacts password, payment, token, and one-time-code fields, then cleans the page URL. Known secret-looking query values are replaced with [redacted]. Extra names you add in settings are included. Matching substrings are also removed from title, description, URL, and pins.

The copied visual-context block keeps captureId even if the rest of the payload cannot be parsed. Inline screenshot bytes are dropped from the text bundle so the copy keeps a file path or viewer URL instead. If some regions could not be inspected, the paste includes a privacy warning.

• After a copy, read the privacy warnings in the paste; some regions may be marked as not inspected.
• Add extra query-key names as comma-, space-, or semicolon-separated tokens; matching is case-insensitive.
• If pasted handoff JSON still contains a data: screenshot URL, recapture so the text bundle keeps a path or viewer URL instead.