PDF redaction guide
Sanitize PDF metadata without a false all-clear
A useful sanitized copy is narrow and verifiable. It should state exactly which fields and attachment structures were removed, preserve the source, and refuse unsupported rewrites.
Work on a copy
Hash and retain the original. Write a separate output with a clearly different name so inspection and remediation cannot silently alter the reviewed evidence.
Define the supported scope
A bounded PDFKit workflow can clear standard Title, Author, Subject, Creator and Keywords values and remove FileAttachment annotations. It should not imply that all page content or annotations were sanitized.
Block unsafe rewrites
Embedded XMP, catalog EmbeddedFiles, encryption and unsupported annotation structures need a stronger rewrite engine or manual process. Refuse the copy rather than preserve them behind reassuring language.
Re-inspect the output
Verify that the supported fields and attachments are gone, calculate the output SHA-256 and confirm that the source hash did not change.
Retain remaining findings
Comments, forms, visual content and technical producer/date metadata may remain. Carry those results into the output receipt and keep legal or regulatory judgment with a qualified reviewer.