Description

GZIPLocalFileHandler.RemoveIdentity uses exec("bash -c sed ...") to strip suppressed user records from an NDJSON gzip file. Two problems with that:

1. Shell injection surface: every suppressed user ID is interpolated into a bash command. We sanitise with regexp.QuoteMeta, but those quotes regex metacharacters — it does not escape shell
   metacharacters. Inputs like $(...) or backticks remain risky.
2. Does not scale with suppression list size: sed runs every pattern against every line, so cost grows O(records × users). For 10k records × 100 users, it takes ~1.27s (1 MB/s).

As part of this change, we are using a feature flag and adding native Go support for removing identity. we will be iterating line by line and deleting the lines that have the suppressed userIDs.

Benchmarks

Linear Ticket

pipe-2904

Security

• The code changed/added as part of this pull request won't create any security issues with how the software is being used.