feat: add configurable sensitive word detection

[Timik232]

Summary

Adds a new SENSITIVE_WORD entity type that allows detecting user-defined sensitive words via the MASKER_SENSITIVE_WORDS environment variable.

Changes

• New entity type: SENSITIVE_WORD added to EntityType
• Config: MASKER_SENSITIVE_WORDS env var (comma-separated word list)
• Detection: Case-insensitive regex with \b word boundaries
• Overlap handling: Lowest priority — loses to EMAIL, CARD, PHONE, PERSON
• Masking/Redaction: Full support via existing endpoints
• Policy: sensitive_word: mask in default policy

Usage

MASKER_SENSITIVE_WORDS="secret,confidential,password" python -m app.main

curl -X POST /api/v1/detect -d '{"text": "This is a secret document"}'
# Returns: {"entities": [{"type": "SENSITIVE_WORD", "value": "secret", ...}]}

Testing

• Added tests/test_sensitive_words.py with class-based tests
• All existing tests pass without modification
• Tested with Cyrillic words (e.g., MASKER_SENSITIVE_WORDS="СВО")

[kiku-jw]

Blocking correctness/security issue in app/services/pii_detector.py:

SENSITIVE_WORD is documented as the lowest-priority entity, but _remove_overlaps() sorts primarily by start offset and then greedily accepts the first match. A configured phrase that starts before an overlapping EMAIL therefore suppresses the EMAIL match. Reproduction against the PR merged with current main:

settings.sensitive_words = "Contact test"
PIIDetector().detect("Contact test@example.com")
# => only SENSITIVE_WORD(0, 12)

POST /api/v1/mask then returns ***@example.com, leaking part of the email address. Please make overlap selection honor entity priority across the whole overlapping range (not only identical start positions) and add a regression test where a sensitive phrase starts before an overlapping EMAIL.

Verification performed on the clean merge with current main: ruff check app tests, ruff format --check app, and the full test suite passed (100 passed, 19 skipped); the targeted overlap reproduction above still fails the security expectation.

[kiku-jw]

Thank you for the contribution and for taking the time to add tests. After reviewing the project status, Masker is currently parked as a portfolio/maintenance-only project, so we are not taking on new feature expansion.

The overlap issue in the review would require additional security-sensitive redesign, and it would not be fair to ask you to spend more time on that for a feature we do not plan to ship. Closing this as not planned rather than waiting for changes. The contribution remains preserved in the PR history.

[kiku-jw]

I reconsidered this after reviewing the product value: an external contribution is itself useful demand evidence. Your implementation has now landed on main via #26, with your original commit and authorship preserved.

I added a safety fix so a configured phrase cannot partially override higher-priority PII (for example, expose part of an email), plus API/docs coverage. Thank you for contributing this feature.