PDF dataset card promises 'PII + secrets masked', but the ingest command the wizard emits has no masking flags (CR-A18-004) #396

Wave 1 · theme D1-4: Data audit, PII/secret detection and ingestion · highest severity High · 1 finding(s) · effort trivial

Summary

The PDF card says 'ForgeLM will ingest these to JSONL before training (PII + secrets masked).' (translations.js:1562). buildYaml only writes a comment telling the operator to run forgelm ingest <dir> --recursive --output data/corpus.jsonl (wizard.js:619-621). Masking in ingest is opt-in via the store_true flags --pii-mask / --secrets-mask / --all-mask (cli/_parser.py:256-275). An operator who follows the wizard therefore writes unmasked personal data and credentials from external documents (IN-05, TC-U content) into the training corpus, while the UI says they were masked. ForgeLM also does not ingest automatically 'before training'.

Primary finding

CR-A18-004 — PDF dataset card promises 'PII + secrets masked', but the ingest command the wizard emits has no masking flags

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end

What happens. The PDF card says 'ForgeLM will ingest these to JSONL before training (PII + secrets masked).' (translations.js:1562). buildYaml only writes a comment telling the operator to run forgelm ingest <dir> --recursive --output data/corpus.jsonl (wizard.js:619-621). Masking in ingest is opt-in via the store_true flags --pii-mask / --secrets-mask / --all-mask (cli/_parser.py:256-275). An operator who follows the wizard therefore writes unmasked personal data and credentials from external documents (IN-05, TC-U content) into the training corpus, while the UI says they were masked. ForgeLM also does not ingest automatically 'before training'.

Where.

• site/js/wizard.js:618-621
• site/js/translations.js:1556
• forgelm/cli/_parser.py:256-275
• site/js/translations.js:1951
• site/js/translations.js:2747
• site/js/translations.js:3537
• forgelm/cli/subcommands/_ingest.py:101-103
• forgelm/ingestion.py:2226-2227
• site/js/wizard.js:516-522
• site/js/translations.js:2352

Evidence.

• Emitted comment for case pdf/preset_domain-expert: '# forgelm ingest ./policies/ --recursive --output data/corpus.jsonl' (no mask flags).

Recommended fix. Add --all-mask (or --pii-mask --secrets-mask) to the emitted command, and fix the card text in all 6 locales.

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}