File hygiene for journalists — and the sources who trust them
Say a reporter — call her Nadia — receives a document from a source who took a real risk to share it. Nadia writes the story, and to show her work she posts the underlying file. The words are fine. But the file's metadata still lists the author, the machine it was created on, and edit timestamps. In the wrong hands, those breadcrumbs can help identify who leaked it.
This isn't hypothetical caution — metadata has burned sources before. A document is never just its text.
Where the breadcrumbs hide
- Author, company, last-edited-by in Office and PDF metadata.
- Tracked changes and comments that survive a careless "accept all."
- Hidden or "vanished" text and earlier revisions inside the file.
- GPS and device details in any photo of a document or a scene.
- Invisible characters that can fingerprint a specific copy of a text.
The habit: check every file before it moves
Before you publish, share, or even forward a file, run it through scrub on your own machine — nothing is uploaded. It reads the document and shows a clear, ranked list of what's inside: author metadata, hidden text, tracked changes, macros, invisible characters, and (for images) GPS and camera data. You see the risk before anyone else does.
For Word and PDF files, scrub shows you what to strip so you can produce a clean copy and re-check. For images — a photographed document, a screenshot — it removes the metadata for you, losslessly and locally.
One honest caveat
scrub protects against the metadata and hidden-content leaks you can see and remove. It is not a full operational-security program: if the stakes are high, pair it with secure channels, careful handling, and a plan for the whole chain — not just the file. Cleaning the file is a necessary step, not the only one.
Make the check a reflex. It takes seconds, and it's the difference between publishing a story and publishing a source. Get scrub free.