Show HN: PII-Shield – Log Sanitization Sidecar with JSON Integrity (Go, Entropy)
aragoss Tuesday, February 03, 2026
What PII-Shield does: It's a K8s sidecar (or CLI tool) that pipes application logs, detects secrets using Shannon entropy (catching unknown keys like "sk-live-..." without predefined patterns), and redacts them deterministically using HMAC.
Why deterministic? So that "pass123" always hashes to the same "[HIDDEN:a1b2c]", allowing QA/Devs to correlate errors without seeing the raw data.
Key features: 1. JSON Integrity: It parses JSON, sanitizes values, and rebuilds it. It guarantees valid JSON output for your SIEM (ELK/Datadog). 2. Entropy Detection: Uses context-aware entropy analysis to catch high-randomness strings. 3. Fail-Open: Designed as a transparent pipe wrapper to preserve app uptime.
The project is open-source (Apache 2.0).
Repo: https://github.com/aragossa/pii-shield Docs: https://pii-shield.gitbook.io/docs/
I'd love your feedback on the entropy/threshold logic!