move sanitize_hash to lib