Sanitization & PII Redaction
Relevant source files
The following files were used as context for generating this wiki page:
Sanitization and PII (Personally Identifiable Information) Redaction in e-zer0 protects sensitive user data before it reaches AI agents. The system identifies and masks private information within email content and detects potential prompt injection attacks designed to hijack AI behavior.
This module runs on the Cloudflare Workers edge runtime and has zero external dependencies. It ensures that even if an AI model is cloud-hosted, the raw sensitive data—such as passwords, credit cards, and API keys—is never transmitted to the AI provider.
Sources: README.md:46-52, src/lib/sanitizer.ts:3-4
System Architecture
The sanitization process integrates directly into the Model Context Protocol (MCP) toolchain. When an agent requests email content, the system retrieves the raw text, processes it through redaction and injection detection layers, and returns a SanitizeResult.
The diagram shows the sequential data flow from raw input to the final sanitized output, including conditional warning logic.
Sources: src/lib/sanitizer.ts:175-225, src/mcp/tools.ts:60-84
PII Redaction
The system uses a predefined list of regular expression patterns to identify and replace sensitive information. Each match replaces the original text with a standardized redacted label (e.g., [CREDIT_CARD_REDACTED]).
Redaction Categories
| Category | Pattern Name | Target Data Type |
|---|---|---|
| Financial | credit_card | Visa, Mastercard, Amex, Discover (formatted or raw) |
| Financial | cvv | 3-4 digit security codes following common labels |
| Financial | bank_account | IBAN, SWIFT, and labeled account/routing numbers |
| Identity | national_id | US SSN, UK NINO |
| Identity | tax_id | Australian TFN, Canadian SIN |
| Security | password | Labeled passwords, PINs, secret keys, access tokens |
| Security | temp_password | OTPs, verification codes, and reset codes |
| Development | api_key | AWS Keys, OpenAI keys, GitHub PATs |
| Development | private_key | RSA and generic private key blocks |
Sources: src/lib/sanitizer.ts:16-92, src/lib/sanitizer.test.ts:18-100
Prompt Injection Detection
The sanitizer scans email content for malicious instructions intended to manipulate the AI agent. It evaluates these attempts based on severity levels to calculate a total riskScore.
Injection Patterns and Severity
- High Severity (30 points):
- System Overrides: Phrases like "ignore all previous instructions" or "forget everything".
- Role Manipulation: "You are now", "act as", or direct system/assistant role markers (e.g.,
[INST],<|im_start|>). - Exfiltration: Commands to "send", "post", or "fetch" data to external URLs.
- Prompt Reveal: Requests to "show", "reveal", or "print" system instructions.
- Encoded Payloads: Attempts to use
atob,eval, ordecode.
- Medium Severity (15 points):
- Exfil Encoding: Instructions to "encode", "base64", or "hex" data before sending.
- Separator Attacks: Multi-line separators (e.g.,
-----) followed by instructions. - Markdown Injection: Manipulated image tags used to exfiltrate data via callbacks.
Sources: src/lib/sanitizer.ts:96-160, src/lib/sanitizer.ts:213-219
Implementation Details
SanitizeResult Interface
The sanitizeEmailContent function returns a structured object containing the cleaned text and metadata about the redactions and risks found.
export interface SanitizeResult {
sanitizedText: string;
redactions: Array<{ type: string; count: number }>;
injectionWarnings: Array<{ type: string; severity: string; match: string }>;
riskScore: number; // 0-100, higher = more suspicious
}
Sources: src/lib/sanitizer.ts:164-169
Risk Scoring and Warning Logic
Risk scores are additive but capped at 100. If the riskScore reaches 50 or higher, the system prepends a safety warning to the sanitizedText.
if (riskScore >= 50) {
sanitizedText = `⚠️ [e-zer0 SAFETY WARNING: This email content scored ${riskScore}/100 on prompt injection risk. Content has been sanitized but exercise caution.]\n\n${sanitizedText}`;
}
Sources: src/lib/sanitizer.ts:222-224, src/lib/sanitizer.test.ts:153-157
Integration in MCP Tools
The sanitizeMessages helper in src/mcp/tools.ts ensures that every field of an email (subject, snippet, body) is sanitized before being returned to the agent. It aggregates security metadata into a _security object attached to each message.
This diagram illustrates how the tools module acts as a controller, ensuring no raw content bypasses the sanitizer.
Sources: src/mcp/tools.ts:60-84, AGENTS.md:68-70
Conclusion
The Sanitization & PII Redaction system is a critical security boundary in e-zer0. By combining comprehensive regex-based redaction with multi-severity prompt injection detection, it allows users to utilize powerful AI models while maintaining control over their private information and protecting their agents from malicious manipulation.