I've been taking a look at the ProjectAnonymizer plugin on the SDL AppStore to help with our GDPR compliance.

We usually work with external suppliers by sending them project packages. One problem I've noticed with this plugin is that the .sdlproj file embedded within the project package contains a list of all of the regular expressions used to encrypt/tokenise data. This is fine for more abstract regular expressions, but literal expressions may end up exposing what you were trying to anonymise in the first place.

For example, let's say I had a client called "Test Company Name" and I wanted to tokenise every instance where their name appears in a document. If I was to write a rule to encrypt this company name, there's not really any other way to express this as a regular expression other than to write it out literally as "Test Company Name". In other words, the company name and the regular expression are one and the same. For these types of expressions, I would still be able to reveal what I've encrypted by looking in the .sdlproj file, like this:

I know that most people would normally not think to look inside an .sdlproj file, but the fact that it's possible means that the tokenised data isn't truly anonymous. Does anyone know if it's possible to exclude this chunk of XML from project packages?

I'm using v2.2 of the plugin for Studio 2017, so maybe this was addressed in the 2019 version?