A few weeks ago I was reviewing logs from a side project and found an email address sitting right there in plain text, in a log line I'd written months earlier and completely forgotten about. Nothing bad happened, but it bugged me enough that I went looking for a fix. What I found was a pile of tools that all had the same shape: "sure, we'll redact your logs, just tell us which fields to redact first."
Pino has a built-in redact option. There's fast-redact. There's mask-json. All good tools, all doing exactly what they say. But every single one of them wants a list of paths up front — req.headers.authorization, user.password, body.creditCard, and so on. Which means the day someone on your team adds a new field with a customer's phone number in it, nothing redacts it, because nobody told the tool to look for it.
That gap — detecting PII by what it looks like instead of by what it's named — is what I ended up building. It's called piiguard, and it's a thin wrapper around Winston and Pino, not a new logger.
What it actually does
You wrap your existing logger, and it auto-detects emails, credit card numbers, SSNs, phone numbers, JWTs, and API-key-shaped strings by pattern, plus a list of common secret field names (password, token, apiKey, etc.) by key name. Zero config to get the baseline working.
