Personal data (PII)

Flags personal data appearing in prompts. Default: report.
What it detects
Email addresses
International phone numbers, where a country prefix is present
IBANs, validated by checksum rather than merely shaped like one
Payment card numbers, validated with the Luhn check
The checksum validation on the last two matters: it means a random 16-digit number in a
test fixture does not become a card-number incident.
Why you would care
Two reasons, usually. Under GDPR, sending customer personal data to an AI provider is a
processing activity you need to have thought about. And separately, most engineering teams
simply do not intend to paste production data into a chat window — this is how you find
out that it happens.
Tuning
Start at report. Look at where the findings cluster: if they come from one team
debugging with real data, that is a conversation, not a policy setting. If they are spread
evenly, consider warn so developers get feedback in the moment.
Block is aggressive for this detector — an email address in a prompt is often
completely legitimate — so most organizations stop at warn.