phi-pii-leak-scan

Run targeted grep patterns across source files for emails, phone numbers, SSNs, credit cards, JWT tokens, and coordinates, excluding test factories and build directories. Then audit serializers and GraphQL types for overly broad field exposure on sensitive models.

Search for serializers using fields = '__all__' on models containing PHI or PII, and grep for sensitive field names like tokens, risk scores, or notes appearing outside models.py and migrations. Explicit field whitelists prevent accidental exposure.

Yes, it scans Python backend files for hardcoded PII and logging leaks, plus TypeScript and TSX frontend files for localStorage writes, console logging of user data, Redux state caching of PHI, and dangerouslySetInnerHTML usage.

CRITICAL findings are PHI fields like clinical notes or risk scores exposed in unauthenticated endpoints. LOW findings include verbose serializers using fields = '__all__' or console.log statements containing user objects.

Fixture files often contain realistic-looking test data that triggers pattern matches. Verify emails use @example.com, phone numbers use 555- prefixes, and coordinates map to oceans; also ignore auto_now_add timestamp fields.