Solo Verify
What it does
verify takes a redacted PDF and, optionally, a list of the strings that were meant to be removed.
It checks the file for six failure classes, the ways a redaction can fail while the page still
looks redacted, plus a check of /Info metadata:
an unapplied redaction: a /Redact annotation marks the text but was never applied, so the text
is still in the page;
a drawn box over live text, including covers drawn as paths, covers drawn inside a Form XObject,
and whiteout with retype: a white box painted over a value, with replacement text drawn on top;
an annotation drawn over the text: a /Square, /Circle, /Polygon or /Ink annotation, a /Stamp, or
a form field whose appearance fills the area;
an image placed over live text;
unreadable text under a cover: glyphs with no /ToUnicode map, so their text cannot be read back,
still in the page under a cover of any kind above;
a prior revision of the file, kept by an incremental save, that still contains the text.
The metadata check looks for target text in the document's /Info dictionary.
It then writes a certificate. The certificate is deterministic: it has no timestamp, so the same
inputs give the same bytes. It is bound to the SHA-256 of the PDF and the SHA-256 of the target
list, and it never contains a target value or any hidden text it found.
How it runs
verify is a single Go binary that runs on your machine. It uses poppler’s pdftotext, which must
be on your PATH. There is no service and nothing is uploaded: nothing leaves your machine.
It is sold under a flat licence.
Results
We ran verify on 200 court filings from the RECAP archive whose docket entries describe them as
redacted. 188 passed and 
12 failed. One document leaks: a chart filed twice, as two different
files, with black bars over email addresses and the text still under the bars, set in Type3 glyphs
with no /ToUnicode map. The other 10 failures are signature images and white boxes over text the
filer did not mean to hide, which verify reports for a person to look at.
The full write-up.
Get it
Download the binary and a sample file set, or read the licence.
