LowFile-scopePHP Plug & play

Log redaction via Monolog processor

Register a Monolog processor to mask emails/phones and attach pii_redacted:true; forbid direct logging of raw identifiers.

Add to Mesrai Open workspace

Why this matters

Centralized redaction prevents accidental leakage across codepaths.

Bad vs. good

Side-by-side examples engineers can pattern-match during review.

Avoid

$logger->info('signup', ['email' => $email]);

Prefer

$logger->pushProcessor(function(array $record){
 $msg = json_encode($record['context']);
 $msg = preg_replace('/[\w.+-]+@\w+\.[\w.-]+/','[redacted-email]',$msg);
 $record['extra']['pii_redacted'] = true;
 $record['context'] = json_decode($msg, true);
 return $record;
});

More snippets

Good

$logger->info('login', ['email_hash' => $hash]);

Bad

$logger->info('login', ['email' => $email]);

Related rules

From the same buckets as this rule.

Critical
Idempotent Right to Erasure across all stores
Provide a single idempotency-keyed erasure workflow that scrubs PII in primary DB, caches, search indices, and object storage; emit an audit event with erasure_request_id. (GDPR Art. 17)
compliance-gdprprivacy-pii+2
High
Encrypt PII at rest using application-layer crypto
Encrypt sensitive columns (e.g., email, phone) with managed keys; ensure DB connection enforces TLS. Store only ciphertext; compare via deterministic token/hashes when needed. (GDPR Art. 32)
compliance-gdprsecurity-hardening+1
High
Enforce retention with explicit TTL per data category
PII tables must include an expires_at (or retention_policy) column and a scheduled deletion/archival job aligned to data category. No indefinite retention. (GDPR Art. 5(1)(e))
compliance-gdprprivacy-pii+2

Why this matters

Bad vs. good

More snippets

Related rules

Idempotent Right to Erasure across all stores

Encrypt PII at rest using application-layer crypto

Enforce retention with explicit TTL per data category

Why this matters

Bad vs. good

More snippets

Related rules

Idempotent Right to Erasure across all stores

Encrypt PII at rest using application-layer crypto

Enforce retention with explicit TTL per data category