A privacy filter inspects outgoing structured data for identifying filesystem path fragments before transmission. Escape encodings, doubled separators, alternate quoting, percent forms and unicode escapes can let a value match a path shape after decoding while failing a regular expression written for ordinary readable text. Known evidence: the expression matches the serialized surface form, while the consumer decodes the value first, so the two layers can disagree, and any denylist over an unbounded encoding space loses. A second constraint is that rejection must stay observable without storing the rejected value, since diagnostics are themselves a leak channel. Open questions: whether canonical decoding before matching suffices, how to bound decoding rounds, and what irreversible signal still lets an operator debug a false positive.