CipherGate v0.17.0

Policies can now be built in layers. A shipped baseline pack, a jurisdiction pack (US, EU or
India) and your own small file merge into one policy, and a later layer cannot quietly weaken
an earlier one. The packs are templates requiring review, not legal or compliance advice.

Added

• Policy layering: extends: [pack, ...] builds one effective policy from shipped packs plus
  your own file. Layers merge so that a later layer can never quietly weaken an earlier one.
  Conflicting context pins, weaker settings or requirements, disabled detectors, and rules or
  defaults that would override an earlier block, review or transform with something weaker
  fail validation. A rule may weaken an earlier rule or default only by naming it in the new
  relaxes field; this is reported as a warning. Earlier hard and guardrail rules can
  never be relaxed.
• Shipped packs (templates requiring review): healthcare_baseline, a strict global healthcare
  default, and us_hipaa, field classifications modelled on the HIPAA Safe Harbor identifier
  list, with ages over 89 shown as 90+. us_hipaa is not Safe Harbor or Expert Determination
  by itself.
• New template hospital_us_override, an example hospital layer on top of us_hipaa.
• Packs eu_gdpr and india_dpdp (templates requiring review, not legal advice). eu_gdpr
  blocks GDPR Art. 9 special-category fields toward external destinations and reviews them
  elsewhere, and finds member-state identifier fields plus Italian codice fiscale values.
  india_dpdp finds grouped Aadhaar numbers, ABHA numbers and addresses, PAN and Indian
  identifier fields, and blocks SPDI-style sensitive fields toward external destinations. One
  policy can extend several jurisdiction packs.

Changed

• When equally protective findings overlap in one value, the more confident one now names the
  redaction marker (for example a grouped Aadhaar number is marked pii.government_id, not
  pii.phone). What gets removed is unchanged.
• Reports list the policy's layers (name, kind, source, file digest), and each decision names
  the layer that made it. policy.digest now covers every layer. validate-policy prints the
  layer chain and adds layers to its JSON output. The terminal summary and the review page
  show the layer next to the rule id.

---

Install: pip install ciphergate-cli==0.17.0

CipherGate is not legal advice, a compliance system, or a certified de-identification service. The healthcare_baseline, us_hipaa, eu_gdpr and india_dpdp packs are templates requiring review. A successful run means the configured processing completed; it does not prove the output contains no sensitive information.

CipherGate v0.16.0

ciphergate review writes a local HTML page that shows, as a trace, what sanitize would change
and how the run went. The CLI's other commands and the report format are unchanged.

Added

• ciphergate review INPUT --policy P -o page.html writes one local HTML page that shows
  what sanitize would change. It covers findings, how many are transformed, kept, blocked
  or waiting for review, a per-category table, rescan results, possible partial finds,
  and each record with its changes highlighted and labelled with category, action, rule
  and reason code. No sanitized file is written. The page holds the would-be output; the
  raw input is added only with --include-input. The page has no scripts, loads nothing,
  is written atomically, and is not overwritten without --force. The exit code matches
  plan. The page is laid out as a trace: a tree of the run, its steps with timings, and the
  records; each record opens as Input and Output panels.
• scripts/benchmark/ner_names.py measures the optional NER detector on generated log lines.
  With en_core_web_sm it found any part of 57-59% of names and the whole name in 41%, missed
  most lowercase and upper-case names, and flagged 3 of 16 name-free lines. Details and limits
  are in docs/detector-coverage.md. The detector itself is unchanged.

Install: pip install ciphergate-cli==0.16.0

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information; detectors can miss values.

CipherGate v0.15.0

JSON reports now include the next-step hints, so CI pipelines can act on them. The field is new; nothing existing changes.

Added

• JSON reports (single-file and directory) include next_steps: the hints from the terminal summary as {"code", "message"} pairs, empty for a successful run. The field is new and optional to read; the schema names are unchanged.

Fixed

• The batch_empty error for a directory with no recognised files now mentions --extension-format.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

CipherGate v0.14.0

Adds --extension-format for mixed directories and tests the optional NER detector against a real Presidio install. No existing behaviour changes.

Added

• --extension-format EXT=FORMAT on inspect, plan, sanitize and rescan (repeatable) reads files with that extension as FORMAT, for directories and single files. It adds unknown extensions or replaces built-in ones, and cannot be combined with --format. The Python API takes RuntimeSettings(extension_formats=...).
• Tests that run the optional NER detector against a real Presidio install with the en_core_web_sm model, including a sanitize run with network access disabled. They skip when Presidio is not installed. A new non-required CI job, ner, installs the extra and a hash-pinned model and runs them.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

CipherGate v0.13.0

Fewer random IDs are reported as payment cards. Cards with an unrecognised prefix and no card keyword nearby are no longer reported, so check that your data is still covered.

Changed

• luhn_card reports fewer random IDs as cards. A Luhn-valid number now needs a known issuer prefix or a card keyword nearby, and an issuer-prefixed number right after an ID word such as invoice or batch id needs a card keyword. JCB, UnionPay, Diners Club, Mir and Discover 644-649 prefixes are now recognised. Cards with other prefixes and no keyword are no longer reported.

Fields named like card_number or pan are still detected by field name. See docs/detector-coverage.md for the gaps.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

CipherGate v0.12.0

Blocked runs now say what to do next, and directory runs no longer hide files they never scanned. A strict directory rescan that skips files with unrecognised extensions now exits 7 instead of 0.

Added

• Blocked, review and failed runs print next: lines in the terminal summary: what to pass, what to change in the policy, or what to remove from the input. The hints come from reason codes and never include input values. The JSON report is unchanged.
• docs/policy-schema.md explains hard and guardrail rules.
• .out and .err files are read as plain text, in directories and as single files.

Fixed

• Directory runs warn when files were skipped because their extension is not recognised, so a COMPLETED run no longer hides files that were never scanned. A strict directory rescan now fails (exit 7) when it skipped such files, and sanitize says they are not in the output.
• Directory runs warn when --format is applied to files whose extension means another format.
• Directory summaries show the same next: hints as single-file runs.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

CipherGate v0.11.0

Makes a clean rescan harder to mistake for proof of safety. Scripts that read PASSED from the rescan terminal output need updating; exit codes and the JSON report do not change.

Changed

• The rescan terminal summary no longer prints PASSED. It says NO GATING FINDINGS, or NOT ENFORCED when gating findings remain with strict off, and states what rescan cannot see.
• validate-policy warns when a rule or default handles credential.secret with anything other than block or review toward a possibly untrusted destination.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

v0.10.0

Fixes a password leak in nested values and detects more credentials and identifiers. A run that passed before can now redact, review or block, so re-check your policies before upgrading a gate.

If you use 0.9.0 or earlier: in values nested like {"...password":{"value":"..."}}, such as Spring Actuator dumps, only the opening brace was redacted and the password stayed in the output. Check any output you shared from logs of this shape, and rotate those credentials if needed.

Install

python -m pip install ciphergate-cli

Added

• ssn_pattern detector for dashed US Social Security numbers (pii.government_id). They were labelled pii.phone, so government-ID rules did not apply, and a strict template can now block.

Fixed

• secret_pattern no longer stops at { for nested values.
• secret_pattern now finds camelCase password names, Cookie and Set-Cookie headers, and session and CSRF cookie values. luhn_card finds labelled CVV and CVC values.
• Fewer false alarms: shell PWD paths, code such as settings.X or request.Y on the right of an assignment, and an HTTP status followed by a byte count.

Known limits

Names, addresses and usernames in free text are still missed without other measures, and rescan can pass with them present. See docs/detector-coverage.md. Review output before sharing it.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

Verify the download

sha256sum -c SHA256SUMS

Full changelog: v0.9.0...v0.10.0

v0.9.0

Detects more values. A run that passed before can now redact, review or block, so re-check your policies before upgrading a gate.

Install

python -m pip install ciphergate-cli

Added

• mac_address detector (pii.device_identifier) and iban detector (pii.bank_account, mod-97 check). Both are on by default and can be turned off with detectors.disabled.

Changed

• email_regex also finds percent-encoded addresses (%40) in text.
• secret_pattern finds values assigned to PGPASSWORD, MYSQL_PWD and similar names (DBPASSWORD, ROOTPASSWORD).

These values now follow your policy rules. See docs/detector-coverage.md for what each detector can miss. Person names and street addresses are still missed without the optional NER extra, as are random-looking secrets with no label.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

Verify the download

sha256sum -c SHA256SUMS

Full changelog: v0.8.0...v0.9.0

v0.8.0

Adds the packaged policy templates to the Python API. Existing behaviour is unchanged.

Install

python -m pip install ciphergate-cli

Added

• load_template(name) returns a Policy from a packaged template and template_names() lists the names. An unknown name raises UsageError.

from ciphergate import load_template, template_names

print(template_names())
policy = load_template("developer_logs")

Templates require review for your data and destination. They are not guaranteed-safe defaults.

A successful run means the configured processing completed under the selected policy. It does not prove that the output contains no sensitive information.

Verify the download

sha256sum -c SHA256SUMS

Full changelog: v0.7.1...v0.8.0