privacy-guardian-tools

name	privacy-guardian-tools
description	Privacy scanning tool definitions. Tells the Privacy Guardian agent which tools to check and run. Does NOT install anything. See PREREQUISITES.md for installation.

Privacy Guardian Tools

Required Tools (must have — stop and ask user to install if missing)

Tool	Check Command	Purpose
Semgrep	semgrep --version	SAST — PII/PHI pattern detection in code

Optional Tools (useful but not blocking)

Tool	Check Command	Purpose	When Required
Gitleaks	gitleaks version	Detect PII accidentally committed in git history	Any project handling PII
Trivy	trivy --version	Scan container configs for data exposure	Projects with containers

Scan Commands (run in this order)

Phase 1: Semgrep privacy scan (REQUIRED)

semgrep scan --config=auto --severity ERROR --severity WARNING .
semgrep scan --config=p/owasp-top-ten --severity ERROR --severity WARNING .

Phase 2: PII/PHI pattern detection (REQUIRED — grep-based)

# PII field names in logging statements
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' -iE \
  '(log|logger|console|print|debug|info|warn|error|trace|fatal)\b.*\b(email|ssn|social.?security|password|credit.?card|phone.?number|date.?of.?birth|dob|address|zip.?code|passport|driver.?license|ip.?address|patient|diagnosis|prescription|medication|mrn|medical.?record|health.?plan|biometric|genetic|ethnicity|religion|sexual)' .

# Object dumping in logs (log(user), log(patient), etc.)
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' -iE \
  '(log|logger|console|print|debug|info|warn|error)\b.*\b(user|patient|customer|client|member|subscriber|employee|applicant|beneficiary|claimant)\b' .

# Serialization in logs
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' -iE \
  '(log|logger|console|print)\b.*(stringify|to_json|to_string|toString|repr|serialize|dump|inspect|pprint)' .

# SSN patterns in code
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' --include='*.json' --include='*.yaml' --include='*.yml' -E \
  '[0-9]{3}-[0-9]{2}-[0-9]{4}' .

Phase 3: Healthcare data detection (CONDITIONAL — run if any PHI indicators found)

# FHIR/HL7 references
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' -iE \
  '(fhir|hl7|dicom|icd.?10|cpt.?code|snomed|loinc|ndc.?code)' .

# PHI model/schema fields
grep -rn --include='*.ts' --include='*.js' --include='*.py' --include='*.java' --include='*.cs' --include='*.go' --include='*.rb' --include='*.rs' -iE \
  '(diagnosis|prognosis|prescription|medication|treatment|clinical|medical.?record|patient.?id|provider.?id|health.?plan|insurance.?id|claim.?number)' .