pii-shield-wasi
PII redaction scanner powered by the core Go engine compiled to WebAssembly (WASI). It runs in-process — no network hop — using hybrid heuristic and entropy-based detection.
Installation
pip install pii-shield-wasi
Usage
from pii_shield import PiiShield, PiiShieldConfig
# Initialize the scanner with optional configuration overrides
shield = PiiShield(PiiShieldConfig(
entropy_threshold=4.0,
confidence_score=0.8
))
text = "Connecting to DB with password: MySuperSecretPassword123!"
redacted_text = shield.redact(text)
print(redacted_text)
# Output might redact the high entropy secret based on context
redact() accepts multi-line text. Each line is scanned independently and \n / \r\n endings are preserved, so the output has exactly as many lines as the input (the same contract the CLI gives stdin).
Configuration
PiiShieldConfig accepts these overrides. Any field left unset keeps the core
scanner default, so redaction matches the CLI for the same config.
| Option | Type | Description |
|---|---|---|
entropy_threshold |
float | Shannon entropy cut-off for candidate tokens. |
confidence_score |
float | Hybrid-validation confidence threshold. |
salt |
str | HMAC salt for deterministic [HIDDEN:xxxxxx] tokens. Set it to correlate across processes. |
min_secret_length |
int | Minimum candidate token length before entropy checks apply. |
sensitive_keys |
list[str] | Key names whose values are always redacted (case-insensitive). Replaces the defaults. |
disable_bigram_check |
bool | Disable English bigram analysis (useful for non-English logs). |
adaptive_threshold |
bool | Enable the experimental statistical adaptive-threshold mode. |
entity_type_labels |
bool | Emit [HIDDEN:<type>:<hash>] markers, where <type> names the detector that fired (card, key, context, url, regex, entropy). Off by default; the hash is unchanged. |
sensitive_key_patterns |
list[str] | Regex patterns matched against key names (equivalent to PII_SENSITIVE_KEY_PATTERNS). |
custom_regexes |
list[dict] | Rules forcing redaction: [{"pattern": ..., "name": ...}] (equivalent to PII_CUSTOM_REGEX_LIST). |
safe_regexes |
list[dict] | Whitelist rules exempting matching tokens (equivalent to PII_SAFE_REGEX_LIST). |
fail_policy |
"open" | "closed" |
On an internal error, open returns the input unchanged; closed returns a drop marker. Handled in this wrapper. |
Invalid regex handling
The CLI fails fast on an invalid pattern at startup. The SDK deliberately does
not: an invalid sensitive_key_patterns, custom_regexes, or safe_regexes
entry is ignored and the default is kept, so a bad pattern can never terminate
your Python process. Validate patterns before passing them if you need strictness.
Features
- In-process: runs the Go WASM binary inside Python via Wasmtime — no network hop by construction.
- Low-allocation hot path: the scan loop is optimized to reduce garbage-collection overhead during large log streaming.
- Hybrid scoring: combines static whitelists, regex heuristics, and Shannon entropy, which helps avoid false positives on structured values like UUIDs and IPv6 addresses.
1 maintainer
Metadata
1 maintainer
Release files for pii-shield-wasi 2.2.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| pii_shield_wasi-2.2.3.tar.gz | 1.2 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| pii_shield_wasi-2.2.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.4 MB
Release files / pii_shield_wasi-2.2.3.tar.gz
| Download URL | pii_shield_wasi-2.2.3.tar.gz |
|---|---|
| Size | 1.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ca69f5f3935391f7b564f32a59950f8be008b2b7b148b8cd07720b73141a0979
|
|
BLAKE2b-256 checksum How to use checksums |
2fc5621466169b55daf9b07a3bfabc43f2154726f2e230e5994b4667f96297c4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 8, 2026.
Transparency logRelease files / pii_shield_wasi-2.2.3-py3-none-any.whl
| Download URL | pii_shield_wasi-2.2.3-py3-none-any.whl |
|---|---|
| Size | 1.2 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
031db49b6b8f480e7f2428c3ba72fed0038a63c9407d362809cb85f2f0b79392
|
|
BLAKE2b-256 checksum How to use checksums |
829b53af36fab1196175316f904735f146b14d4bc4361096c4348d18bad5571d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 8, 2026.
Transparency log
