Protect PII in Kubernetes logs with Shannon Entropy & O(1) Regex.
Deterministic hashing for debugging. 100% client-side demo.
PII redaction with the simplicity of a sidecar.
Detects unknown secrets (API keys, tokens) automatically using Shannon Entropy without predefined patterns.
Engineered for high-load sidecars. A low-allocation scan loop keeps the sidecar light on CPU and memory.
Combine entropy checks with Whitelists (Safe Regex). Explicitly allow safe patterns like Git SHAs to prevent false positives.
25-point checklist: where PII leaks from pods, which log paths bypass your filters, and how to verify redaction actually works. Built for DevOps teams preparing for SOC 2 and GDPR audits.
You'll also get new integration guides, detection rules, and release notes. No spam â unsubscribe at any time.
GuardSpine integrated PII-Shield's In-Process WASM to sanitize sensitive evidence trails directly within their Node.js and Python agents.
We chose the WASM architecture to ensure zero network overhead and <1ms latency. PII-Shield runs directly in-process, preserving the referential integrity of our hash chains while keeping logs compliant.
Seamlessly integrates into your existing Kubernetes pods.
PII-Shield runs as a sidecar container in your Pod, capturing stdout/stderr streams via pipe.
It scans log streams against high-entropy signals (secrets) and deterministic salt patterns.
Only clean, sanitized logs are passed through to your logging agent or collector.
Pull the Docker image or download the binary for Linux/Mac/Windows.
# Pull the latest image
docker pull thelisdeep/pii-shield:latest
# Try with JSON input (PII-Shield preserves structure!)
echo '{"msg":"Login", "pass":"SuperSecret123", "id":42}' | \
docker run -i --rm thelisdeep/pii-shield:latest
# Output: {"msg":"Login", "pass":"[HIDDEN:5a1b2c]", "id":42}
âšī¸ Deterministic Redaction: PII-Shield uses HMAC-SHA256 with a salt.
The same secret always produces the same redacted hash (e.g. [HIDDEN:5a1b2c]),
allowing you to correlate logs across services without revealing the data.
40+ tested GDPR redaction rules, DPO-ready documentation and audit-trail templates, on top of the open-source sidecar. Early access, delivered as a ZIP within 5 working days, 14-day refund.
See what's inside â2 minutes, and it directly shapes what gets built next. Every response goes straight to the maintainer â and you can opt in to be quoted (or stay anonymous).
Talk directly with the creator â a 20-minute call about your log pipeline. No sales pitch; I'm the maintainer and I want to understand your setup.
Same format as the GDPR pack: ready-made redaction rule sets, documentation and audit-trail templates. Leave your email and you'll hear when they ship.
Prefer email? Write to me directly. No spam â unsubscribe at any time.