findPii (core/eval-capture-scrub.ts)

Detects and scrubs common PII patterns from text using regex and Luhn checks.

// Source: https://github.com/garrytan/gbrain | License: MIT | Copyright 2026 Garry Tan
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * PII scrubber for captured query text (v0.21.0).
 *
 * Runs before INSERT into `eval_candidates`. Capture is on by default,
 * so plaintext PII sitting in a DB column is a privacy footgun the first
 * time someone exports or shares a brain dump. Six regex families cover
 * the obvious cases:
 *
 *   1. Email addresses
 *   2. Phone numbers (US + international)
 *   3. US Social Security numbers (XXX-XX-XXXX shape, with year-like false-positive guard)
 *   4. JWT-shaped tokens (three base64url segments joined by '.')
 *   5. Bearer tokens (Authorization: Bearer <opaque>)
 *   6. Credit card numbers (13–19 digits with Luhn verification

... (truncated -- full source via MCP)