Redacted History for Sensitive Links
Previously, any link whose input contained sensitive-looking data (auth tokens, e-mails, JWTs, precise coordinates) was kept out of history entirely — even when cleaning removed every sensitive part. This silently dropped common redirect wrappers such as Reddit's out.reddit.com links (functional token= parameter) and Google Ads sig= wrappers.
Now, when the Private Link Guard flags the input but the final cleaned URL is verifiably safe, FixupXer saves a redacted history entry:
- Only the safe final URL is stored — the original wrapper, its token, and its host are never written to the database.
- The history card shows "Sensitive input" / "Original URL was not saved" with an "Input redacted for privacy" badge.
- Copy, Share, open, and delete work on the safe final URL as usual.
Links whose cleaned result still contains sensitive data continue to stay out of history and the cleaner cache completely. Sensitive inputs also still never enter the cleaner cache. No database migration required.
Verification: 652/652 unit + 235/235 instrumentation tests, release lint clean.