[feature]: Automatic PII Detection and Masking in Mocks and Test Cases
- Dominant language
- Go
- Stars
- 18.5k
- Forks
- 2.4k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 101
Description
### 👀 Is there an existing feature request for this?
- [x] I have searched the existing issues
### 🔖 Enhancement description
## Problem Statement
Keploy records real API calls, database queries, and external dependencies from user traffic to generate test cases and mocks. This real data often contains **Personally Identifiable Information (PII)** such as:
- Emails (e.g., `john.doe@example.com`)
- IP addresses
- Phone numbers
- Credit card numbers
- Names, addresses, or other sensitive fields
When these mocks and test cases are:
- Committed to Git repositories
- Shared across teams or environments
- Used in CI/CD pipelines
...there is a risk of unintentionally exposing real user PII, leading to privacy breaches and non-compliance with regulations like **GDPR**, CCPA, HIPAA, etc.
While Keploy has a `keploy sanitize` command (implemented in `cli/sanitize.go`), it currently focuses on basic secret removal. Enhancing it with comprehensive PII detection and configurable masking would significantly improve security and make Keploy safer for enterprise adoption.
### 🎤 Why should this be worked on?
- Prevents accidental PII leaks in shared mocks/tests.
- Minimal overhead (regex-based, no heavy dependencies initially).
### 💻 Repository
keploy
Contributor guide
Research direction
Start with cli/sanitize.go to understand the existing secret-removal behavior and how sanitize is invoked. Define the supported PII categories, masking configuration, and expected handling for recorded mocks and test cases; done means the agreed PII data is detected and masked without exposing real values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100