fix(privacy): validate IP address candidates

ods/extensions/services/privacy-shield/pii_scrubber.py

@@ -5,6 +5,7 @@
 """
 
 import codecs
+import ipaddress
 import re
 import hashlib
 import secrets
@@ -95,6 +96,15 @@ def scrub(self, text: str) -> str:
                 if pii_type == 'credit_card' and not self._luhn_check(match):
                     continue
 
+                # The regex identifies IPv4/IPv6-shaped candidates, but it
+                # deliberately does not encode numeric range rules. Avoid
+                # scrubbing version-like values such as 999.999.999.999.
+                if pii_type == 'ip_address':
+                    try:
+                        ipaddress.ip_address(match)
+                    except ValueError:
+                        continue
+
                 # Check if we've seen this PII before
                 existing_token = None
                 for token, original in self.pii_map.items():

ods/extensions/services/privacy-shield/tests/test_pii_scrubber.py

@@ -145,6 +145,13 @@ def test_compressed_ipv6_round_trips(self, detector):
     def test_clock_time_is_not_an_ip(self, detector):
         result = detector.scrub("Started at 12:34:56 UTC")
         assert "<PII_ip_address_" not in result
+        "candidate",
+        ["999.999.999.999", "256.1.1.1", "192.168.1.999"],
+    )
+    def test_invalid_ipv4_candidate_is_not_scrubbed(self, detector, candidate):
+        text = f"Version-like value: {candidate}"
+
+        assert detector.scrub(text) == text
 
 
 # ── API key detection ────────────────────────────────────────────────────────