GitHub Packages · MIT · Node ≥ 18
Find and redact personal data in log files: emails, phone numbers, IP addresses, card numbers and national IDs.
Find and redact PII in log files: emails, phone numbers, public IPs, Luhn-valid card numbers, US SSNs, UK National Insurance numbers, checksum-valid IBANs, passwords/secrets in fields and dates of birth. Masked report, in-place or copy redaction. SARIF, allowlist with expiry, GitHub Action. Zero deps.
1 Point the @mrlouiswright scope at GitHub Packages in .npmrc
@mrlouiswright:registry=https://npm.pkg.github.com2 Install
npm i -D @mrlouiswright/pii-log-wardenPublished to GitHub Packages, not npmjs.com. GitHub Packages needs a GitHub token with read:packages to install, even for public packages: add //npm.pkg.github.com/:_authToken=${GITHUB_TOKEN} to .npmrc or run npm login --registry=https://npm.pkg.github.com.
$ npx pii-log-warden logs/pii-log-warden — 2 file(s)2 file(s), 0.3 KB scanned CRITICAL test/fixtures/bad/app.log:2 Payment card number 411111******1111 (col 48) [pii-card-number] ↳ fix: Stop logging this value (mask it at the logger), then purge or redact existing logs.HIGH test/fixtures/bad/app.log:3 Password or secret value in a key=value / JSON field password":"******** (col 61) [pii-password-field] ↳ fix: Stop logging this value (mask it at the logger), then purge or redact existing logs.HIGH test/fixtures/bad/app.log:3 US Social Security Number 12*******89 (col 24) [pii-us-ssn] ↳ fix: Stop logging this value (mask it at the logger), then purge or redact existing logs.HIGH test/fixtures/bad/app.log:3 UK National Insurance number AB********* C (col 45) [pii-uk-nino]
Logs are where personal data leaks quietly: a debug line prints the whole request body, an error handler dumps the card number, a JSON logger serialises the user object with its email, date of birth and password. Under GDPR, PCI DSS and most security reviews those logs then become regulated data. pii-log-warden scans log files, directories or stdin, reports every match masked (it never repeats the raw value in its own output) with file, line, severity and a fix, and can redact the files in place or into a clean copy.
CLI, library and GitHub Action. Node.js 18+, zero runtime dependencies, runs offline. By Louis Wright.
email addresses, phone numbers (E.164, UK, North American), public IPv4/IPv6 addresses, payment card numbers (Luhn-checked, issuer prefixes), US SSNs, UK National Insurance numbers, IBANs (mod-97 checked), passwords/secrets/API keys in key=value and JSON fields, and dates of birth.
private and loopback IPs, example.com, masked values (****, [REDACTED]), version strings, timestamps and UUIDs are ignored; add your own service domains with --ignore-email-domains.
files, directories (log-like files by default: *.log, rotated *.log.1, *.txt, *.jsonl, *.json, *.csv, *.out, *.err), or - for stdin (e.g. kubectl logs … | pii-log-warden -). Binary files are skipped.
--redact rewrites files with [REDACTED:email] placeholders (or --mask for j***@acme.io), --redact-dir writes clean copies instead.
# Example
npx pii-log-warden logs/# Example
npx pii-log-warden app.log --fail-on medium# Example
npx pii-log-warden logs/ --redact-dir logs-clean --maskpermissions:
contents: read
security-events: write # only needed for the SARIF upload
jobs:
pii-log-warden:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with: { persist-credentials: false }
- uses: MrLouisWright/pii-log-warden@v1
with:
path: logs
fail-on: high
sarif: pii-log-warden.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with: { sarif_file: pii-log-warden.sarif }| Flag | Description |
|---|---|
| Scan | |
--all-files | Scan every file in directories (default: *.log, *.txt, *.jsonl, *.json, *.csv, *.out, *.err, rotated *.log.1) |
--exclude <globs> | Skip matching paths |
--private-ips | Also report private/loopback IP addresses |
--ignore-email-domains <d> | Email domains to ignore (e.g. your service accounts) |
--max-per-file <n> | Findings per rule per file before summarising (default 50) |
| Redact | |
--redact | Rewrite files with [REDACTED:type] placeholders (in place unless --redact-dir) |
--redact-dir <dir> | Write redacted copies here instead of in place |
--mask | Use masked values (j***@example.org) instead of placeholders |
| Common | |
-c, --config <file> | JSON config (default: .pii-log-warden.json or "piiLogWarden" in package.json) |
-f, --format <fmt> | text (default) | json | sarif | markdown |
--json <file> | Also write a JSON report |
--sarif <file> | Also write SARIF 2.1.0 |
--markdown <file> | Also write Markdown (e.g. for a job summary) |
--fail-on <sev> | critical | high | medium | low | info | none (default: high) |
--list-rules | Print rules and default severities |
--no-fixes | Hide fix suggestions in text output |
--no-color | Disable colours |
Full reference, config file format and API in the README.
Support this project
I build free, open-source tools that help developers ship safer websites. Every coffee helps keep them maintained, documented and free for everyone.
Buy me a coffee (opens Stripe in a new tab)Secure checkout by Stripe
