Show HN: PII-Shield – Log Sanitization Sidecar with JSON Integrity (Go, Entropy)
5 by aragoss | 0 comments on Hacker News.
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC. Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data. Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy analysis to catch high-randomness strings. 3. Fail-Open: Designed as a transparent pipe wrapper to preserve app uptime. The project is open-source (Apache 2.0). Repo: https://ift.tt/dsTCfzH Docs: https://pii-shield.gitbook.io/docs/ I'd love your feedback on the entropy/threshold logic!
5 by aragoss | 0 comments on Hacker News.
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC. Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data. Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy analysis to catch high-randomness strings. 3. Fail-Open: Designed as a transparent pipe wrapper to preserve app uptime. The project is open-source (Apache 2.0). Repo: https://ift.tt/dsTCfzH Docs: https://pii-shield.gitbook.io/docs/ I'd love your feedback on the entropy/threshold logic!