PII-Shield
Log Sanitization Sidecar with JSON Integrity (Go, Entropy)
Details
- External ID
- 46873308
- Source
- HN
- Company
- —
- Product
- PII-Shield
- Website domain
- github.com
- Launched
- Feb. 3, 2026
- Cohort
- —
- Upvotes
- 20
- Upvotes percentile
- 0.6886792452830188
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC.Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data.Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy analysis to catch high-randomness strings. 3. Fail-Open: Designed as a transparent pipe wrapper to preserve app uptime.The project is open-source (Apache 2.0).Repo: https://github.com/aragossa/pii-shield Docs: https://pii-shield.gitbook.io/docs/I'd love your feedback on the entropy/threshold logic!
Enrichment
- Theme
- self-hosted infrastructure and security tools
- Vertical
- Security
- Function
- Compliance & governance
- Audience
- B2B
- AI stance
- Not AI
- Project type
- Commercial product
- Normalized one-liner
- log sanitization for pii removal
- Manually corrected
- False
Could you build this?
Yes A Go sidecar reading from stdout/stdin, calculating Shannon entropy over sliding tokens, and applying HMAC hashing is a well-scoped systems utility easily written with AI assistance.
Discussion
11 comments analyzed.
Concerns raised: Doesn't redact UUIDs by default without threshold adjustment, Focuses on high-entropy secrets, not names or SSNs, May not catch simple test values with default entropy threshold
Feature requests: Redact by Value Regex to catch UUIDs anywhere, Customize UUID redaction without global threshold tuning, Better product naming to clarify it targets secrets not PII
Competitors
Other products that read as similar to this one — 56 launches clear the similarity bar, closest 8 shown.
Attention rank: #22 of 57 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 94 days after the earliest competitor.
- Data Sanitizer · ph · 2026-09-17 · 2 upvotes · similarity 0.44
- Local Privacy Firewall-blocks PII and secrets before ChatGPT sees them · hn · 2025-12-09 · 111 upvotes · similarity 0.41
- maskgate · github · 2026-09-09 · 268 upvotes · similarity 0.41
- Secure Core FFI · ph · 2026-09-14 · 1 upvotes · similarity 0.38
- genpark-pii-anonymizer-credential-scrubber-skill · github · 2026-09-29 · 7 upvotes · similarity 0.38
- A local-first, reversible PII scrubber for AI workflows · hn · 2025-12-24 · 38 upvotes · similarity 0.38
- genpark-document-redaction-pii-scrubber-skill · github · 2026-09-27 · 7 upvotes · similarity 0.37
- LogClaw · hn · 2026-03-12 · 19 upvotes · similarity 0.37
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a compliance & governance tool for Media & entertainment yet.