Fail closed.
When the tool does not know what something is, it removes it. That single default is most of what separates a privacy tool from a tidying tool.
To fail closed is to default to the safe answer when a decision cannot be made confidently. For a metadata scrubber, that means dropping segments it does not recognise rather than passing them through.
What it is
JPEG has sixteen application slots and no registry that anyone is obliged to use. Manufacturers, editors and pipelines all write segments the format never anticipated. A scrubber will encounter payloads whose identifier it has never seen.
There are two possible defaults. Keep the unknown thing, on the grounds that it might be needed. Or drop it, on the grounds that it might be identifying.
Why it matters
An undocumented vendor segment is exactly where a manufacturer parks a serial number. A tool that keeps unknowns will silently pass through every new tracking field any vendor adds after the tool was written, and it will pass through the ones it was never told about at all.
The cost of the other default is that some unrecognised segment might one day turn out to have been load-bearing for some decoder. That is a bug report worth receiving and a new row in the policy table — not a reason to invert the default.
APPn segments are dropped, with the reason unrecognised application segment. There is deliberately no policy file and no per-segment override: the fastest route back to leaking GPS is a configuration somebody edited once and forgot. The comment in src/policy.c puts it plainly — a privacy tool that fails open is not a privacy tool.
Related terms
Common questions.
Has this ever broken a file?
Not in the fixture corpus or in testing. Decoders are required to skip application segments they do not recognise, which is what the marker range is for.
Can I see which segments were unrecognised?
Yes. scrubpony -n labels them "unrecognised" with their marker and payload size, so you can inspect one before deciding it matters.
Get ScrubPony
Strips identifying metadata out of JPEGs without touching a pixel. C99, no dependencies beyond libc, macOS and Linux, MIT-licensed.