There's sort of a catch-22 going on in the example given. you might want to give users a handy tool to find that data and fix it, but you also don't want to giv

There's sort of a catch-22 going on in the example given. you might want to give users a handy tool to find that data and fix it, but you also don't want to give the person that hacked the account a handy tool to find that data and exfiltrate it. I'm actually inclined to believe they aren't showing you specific files by design, for this reason. The real owner may be able to search for a few things,like the last 4 of their credit cards, or prescription names, or their social, and find and remove things, while an attacker would have a much harder time sorting through the data. It doesn't really affect your main point though. Bad regexes and the fight to correctly classify items is always a tug of war between correct and pretty.