PII detection library or pattern coverage present

CWE-359 (Exposure of Private Information) and NIST SP 800-53 Rev. 5 SI-12 (Information Management and Retention) both call for systematic controls on PII exposure. Handwritten regex patterns for PII detection have well-documented failure modes: phone number formats vary by country and era, email local parts accept characters most patterns miss, and edge cases in credit card BIN ranges cause false negatives. An established PII detection library or managed service provides format coverage that ad-hoc patterns cannot match. Even validator (npm, 10M weekly downloads) covers email, mobile phone across locales, and credit card validation with a single dependency.

Install validator for lightweight multi-format PII detection without a managed service dependency:

npm install validator

// lib/ai/pii-guard.ts
import validator from 'validator'

export function containsPii(input: string): boolean {
  return input.split(/\s+/).some(token =>
    validator.isEmail(token) ||
    validator.isMobilePhone(token, 'any') ||
    validator.isCreditCard(token)
  )
}

For higher-stakes applications handling medical or government data, AWS Comprehend DetectPiiEntities covers 100+ PII types including passport numbers and medical record numbers — worth the latency overhead when the data sensitivity warrants it.