feat: add safe configurable sensitive word detection - #26
Conversation
Add SENSITIVE_WORD entity type that detects user-defined words from MASKER_SENSITIVE_WORDS env var (comma-separated). - Case-insensitive word boundary matching - Lowest priority in overlap resolution (EMAIL/CARD/PHONE/PERSON win) - Full support for detect, mask, and redact endpoints - Policy entry in default.yaml
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c89dba773
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| all_entities = regex_entities + ner_entities + sensitive_entities | ||
| unique_entities = self._remove_overlaps(all_entities) |
There was a problem hiding this comment.
When a caller requests only SENSITIVE_WORD, overlap resolution still considers unrequested PII and always gives it precedence. For example, with MASKER_SENSITIVE_WORDS=secret, masking secret@example.com with entities: ["SENSITIVE_WORD"] keeps the EMAIL match, discards the requested sensitive-word match, and then filters the email out, returning the input unchanged. Filter candidates before resolving overlaps so an unrequested entity cannot suppress an explicitly selected redaction.
Useful? React with 👍 / 👎.
0c89dba to
3436dff
Compare
2 participants
Summary
SENSITIVE_WORDconsistently in API schemas, scores, policy, and docsSupersedes #5 with the requested safety fix.
Verification
pytest --cov=app --cov-report=term-missing— 102 passed, 19 skipped, 83.33% coverageruff check app/ruff format --check app/git diff --check