Feature Request: PDF Metadata Scrubber #24

Motivation

PDFs routinely leak far more information than users realize — author names, software versions, GPS data from scanned images, hidden layers, embedded files, and even recoverable text from prior edits. Before sharing a document publicly, users need a reliable, transparent way to detect and strip this hidden data, not just the surface-level "Author/Title" fields most tools cover.

Acceptance Criteria

• Scan uploaded PDF and detect all metadata categories present (see table below)
• Display a checklist of findings before doing anything (e.g. "Author: John Doe", "12 hidden layers", "3 embedded files", "JavaScript detected")
• User can select "Scrub All" or pick specific categories to remove
• Detect digitally signed PDFs and warn the user that scrubbing will invalidate the signature, before proceeding
• Rewrite file fully (not incremental save) to eliminate prior-version history left in old xref sections
• Show a diff/summary after scrubbing (e.g. "Removed 8 metadata fields, 2 hidden layers, 1 script")
• Output is a clean, downloadable PDF

Technical Notes

• Library: pikepdf (Python, wraps QPDF) — gives direct object-structure access that Ghostscript's CLI doesn't expose well
• Critical gotcha: if the PDF is digitally signed (pdf.Root.AcroForm + signature fields present), any byte-level change breaks the signed hash range and invalidates the signature — must detect and warn before scrubbing
• Font metadata removal is harder than the rest; may need to fall back to Ghostscript subsetting rather than pikepdf alone
  Suggested UX Flow

1. Scan and show a checklist of what was found — transparency builds trust
2. Let user select all or pick specific categories
3. One-click "Scrub All" for the common case
4. Show a diff summary after scrubbing

Priority

enhancement pdf privacy security