BASALT · JOURNAL

Inspect a PDF before sharing it: a 10-point check

2026-09-21 · inspect pdf before sharing

The page you see is only one view of a PDF. Before sharing a sensitive file, inspect ten places where information or behavior can survive.

The ten checks

1. Visible pages: read every page, including blank-looking separators and appendices.
2. Extracted text: compare search and copy results with what the page visibly says.
3. OCR layers: on scans, confirm invisible text matches the sanitized image.
4. Metadata and XMP: inspect title, author, company, keywords, dates, and source paths.
5. Comments and annotations: enumerate notes, highlights, replies, stamps, and their author fields.
6. Forms: read stored values, not only current appearances.
7. Attachments: list document- and page-level embedded files.
8. Layers and alternate content: inspect optional-content groups and hidden objects.
9. Scripts and actions: find JavaScript, open actions, links, launches, and submits.
10. History and thumbnails: check incremental revisions, stale previews, and alternate representations.

Use two independent views

One application can consistently misunderstand the same malformed object when editing and checking it. Verify the candidate with a second parser or dedicated inspection path. Search known sensitive values and enumerate object classes structurally.

For image redactions, extract or render the image without overlays and inspect the pixels. For text redactions, test that the target is absent and immediate neighboring text remains exact.

Check the exact outbound file

Combining, compressing, signing, OCRing, or watermarking after inspection creates new bytes. Run the check after the last operation and record the release hash. Compare that hash immediately before sending to avoid selecting the wrong similarly named copy.