4.8PII in Logs: A Testing Concern

QA architects must verify that production logs do not contain personally identifiable information (PII). Add automated PII detection to your log pipeline:

# pii_log_scanner.py
import re

PII_PATTERNS = {
    "email": re.compile(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"),
    "phone": re.compile(r"\b\d{3}[-.]?\d{3}[-.]?\d{4}\b"),
    "ssn": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
    "credit_card": re.compile(r"\b(?:\d{4}[-\s]?){3}\d{4}\b"),
}

def scan_log_entry(log_json: dict) -> list:
    """Scan a structured log entry for PII."""
    findings = []
    text = json.dumps(log_json)

    for pii_type, pattern in PII_PATTERNS.items():
        matches = pattern.findall(text)
        real_matches = [m for m in matches if "example" not in m and "test" not in m]
        if real_matches:
            findings.append({"type": pii_type, "count": len(real_matches)})

    return findings

Structured logging is not just a developer convenience -- it is a prerequisite for every other observability practice in this chapter. Invest in it early.