The following query is not properly scrubbed because it uses a virtual table name:

select * from mysecretdb.pg_catalog.pg_tables

The string "mysecretdb" is not scrubbed.