microsoft / microsoft/agent-governance-toolkit

rag-governance content_scanner SSN pattern misses cued and space-separated forms

Open
#3,815 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.3k
Forks
1.1k
Avg merge
5d 11h
Merged PRs (30d)
142

Description

`agent-governance-python/agent-rag-governance/src/.../content_scanner.py:84` carries a third, independent SSN detector that only matches the dashed form (`\d{3}-\d{2}-\d{4}`). It misses the context-cued bare forms ("SSN: 745102386") and space-separated forms that #3801 is adding to `credential_redactor.py` and `integrations/base.py` (issue #3592).

Once #3801 lands, the three detectors will disagree: content passing rag-governance scanning would be redacted/blocked at the gateway. Suggest either importing the shared pattern set from `credential_redactor` or mirroring the cued-form additions (including whatever boundary guard #3801 settles on for the cue alternation).

Contributor guide

Open the contributing guide

Research direction

Start with agent-governance-python/agent-rag-governance/src/.../content_scanner.py at line 84, then compare its SSN detector with credential_redactor.py and integrations/base.py as updated by #3801. Confirm the chosen shared or mirrored pattern set handles dashed, cued bare, and space-separated forms with the same cue boundary guard. Done means the rag-governance scanner agrees with the other detectors.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.