A GitHub Action that scans PR diffs, log files, and issue text for PII.
Runs entirely in the runner: no service, no network calls, no models.
How it works
One step in any job. Scans PR diffs by default; point it at log files or issue and comment text with mode.
Pattern recognizers plus checksum validation, 45 entity types across 12 countries, locally in the runner. Powered by Alcatraz, hoop.labs’ PII detection library.
Inline annotations, a sticky PR comment with masked values, and a step summary. The check fails until findings are removed or allow-listed.
Flagged in the wild
##[debug]Evaluating condition for step: 'Notify webhook'
##[debug]Response body: {"customer":"Jane Doe","card":"4532 0151 1283 0366","email":"jane.doe@example.com"}
##[debug]cpf=536.904.399-00
##[debug]Step result: successBuilt for regulated pipelines
PR diffs, arbitrary files, and issue or comment text. Capture your test output to a log file and scan it for leaked PII in the same job.
Runs on Alcatraz locally in the runner. No service, no network calls, no models, and nothing sent to a third-party PII detection service.
Findings are reported with masked values, never re-published. Built for teams accountable to SOC 2, HIPAA, and PCI audits of their CI/CD pipeline.
Need PII masked everywhere it moves, not just in CI?
hoop masks sensitive data across every protocol it proxies, databases, shells, and cloud consoles, with the same verified detection built into Alcatraz.