feat(data-protection): Intelligent Sensitive Data Detection and Redaction

[jusso-dev]

Problem

Application logs frequently contain passwords, API keys, JWTs, session cookies, email addresses, credit card numbers and other sensitive information.

Sending this data to a SIEM increases risk, breaches privacy requirements and unnecessarily increases storage costs.

Bower should automatically detect and protect sensitive information before it leaves the source environment.

Goal

Implement a configurable privacy engine that inspects every event for sensitive information before forwarding.

Features

Built-in Detection

Automatically identify:

• Passwords
• API Keys
• JWT Tokens
• OAuth Tokens
• Session Cookies
• AWS Access Keys
• Azure Secrets
• Private Keys
• Connection Strings
• Credit Card Numbers
• TFNs
• Medicare Numbers
• Email Addresses
• Phone Numbers
• IP Addresses
• Custom Regex Patterns

Actions

Support:

• Mask
• Hash
• Remove
• Tokenise
• Encrypt
• Allow-list Exceptions

Configuration

• Per-field policies
• Per-source policies
• Organisation-wide defaults
• Custom detection rules
• Preview mode
• Audit logging

Reporting

Generate reports showing:

• Number of secrets detected
• Most common sensitive fields
• Redaction statistics
• Policy violations
• Trend analysis

Success Criteria

• High-performance scanning
• Minimal processing overhead
• Configurable privacy policies
• Complete audit trail
• Zero sensitive data leakage

Why

Telemetry should improve security, not introduce new privacy and compliance risks.

Bower should ensure organisations can safely centralise logs without exposing credentials, secrets or personal information.