The terminal waits for you, cursor blinking, as you type man grep without thinking. But hidden in plain sight, manpages can carry more than syntax and flags. They can contain PII data — and that risk lives on every Unix-like system.
Manpages are documentation files. Most ship with the system or a package manager. But in some environments, manpages are generated or patched from local sources. That’s where the problem starts. Build scripts, version control leaks, or unfiltered examples can push names, emails, API keys, and internal URLs into these files. Once installed, this data is available to any user with read access.
PII data in manpages becomes a compliance and security issue fast. Sensitive information in documentation may violate GDPR, HIPAA, or internal controls. Attackers can search /usr/share/man or run man -wa to harvest targets. Security audits often skip this layer because they focus on logs, configs, and live services. That makes manpages an attractive hiding place for forgotten secrets.