sg-pii-rules v0.2.0

Four new kinds of Singapore personal data and one specification change, reviewed and approved by Michael Mendoza on 2026-10-06. Vendored files are byte-identical to v0.2.0-rc.1, so existing SHA256SUMS checks stay valid.

Entity	What it finds
CARD	Card numbers passing the Luhn check with a card network's prefix and length (ADR 0009)
POSTAL	Six-digit postal codes after an address clue, valid sector 01–82 except 74 (ADR 0011)
UNIT	#floor-unit numbers such as #05-123
DOB	Real calendar dates directly after a birth clue (ADR 0012)

Specification: a pattern may name one value group; only it is reported, the rest is required context (ADR 0010). Implementations must support it for the POSTAL and DOB fixtures.

Evidence: 369 conformance cases passed by two independent implementations (TypeScript reference, Discreet in Go); measurements on 36 MB of real code in EVALS.md; CV numbers in docs/CV-NUMBERS.md.

v0.2.0-rc.1 (release candidate)

Release candidate from the next integration branch, for Discreet to vendor (ADR 0008). The final v0.2.0 will be tagged on main after Michael Mendoza's Milestone 2 review, with byte-identical vendored files.

New in 0.2.0

Entity	Detector	What it finds
CARD	payment_card	Card numbers that pass the Luhn check and carry a card network's prefix and length (ADR 0009)
POSTAL	sg_postal_code	Six-digit postal codes after an address clue, valid sector 01–82 except 74 (ADR 0011)
UNIT	sg_unit_number	#floor-unit numbers such as #05-123, #B1-23A
DOB	date_of_birth	Real calendar dates directly after a birth clue (ADR 0012)

Spec change (SPEC.md §2): a pattern may name one capture group value; only that group is reported and the rest of the match is required context (ADR 0010). Implementations must support it to pass the POSTAL and DOB fixtures.

Evidence: 369 conformance cases (185 new), 474 tests; no existing expectation changed. Measured on 36 MB of real JavaScript and Go: CARD 3 hits (floating-point literals), POSTAL, UNIT and DOB 0 (EVALS.md §2b–2e).

Vendor it

Copy detectors.json, schema/*.json, fixtures/*.json and SHA256SUMS from this tag, then run shasum -a 256 -c SHA256SUMS in CI.

sg-pii-rules v0.1.0

Shared, tested detection rules for Singapore personal data, used by Vetted and, from Milestone 2, Discreet. All data in this repository is synthetic. Reviewed and approved by Michael Mendoza on 2026-10-01.

Detectors

Entity	What it matches
NRIC	NRIC and FIN numbers (S, T, F, G and M series) with a valid check letter (VALIDATORS.md: the algorithm was never officially published, and every source is graded)
NRIC_LIKE	The NRIC shape with an invalid check letter: mistyped NRICs and look-alikes
PHONE	Singapore numbers per the IMDA National Numbering Plan
EMAIL	Practical email addresses

Evidence

• 184 synthetic conformance cases, all passing; 245 tests.
• Real-code behaviour, published honestly in EVALS.md: PHONE fires on bare eight-digit numeric constants in code, while every EMAIL hit was email-shaped.
• CONTROLS.md maps each feature to PDPC's NRIC guidelines, the PDPA, OWASP, CSA, IMDA and NIST controls.

Use it

Copy detectors.json, schema/*.json, fixtures/*.json and SHA256SUMS from this tag, then verify:

shasum -a 256 -c SHA256SUMS   # or: sha256sum -c SHA256SUMS

These files are byte-identical to v0.1.0-rc.1, so projects that vendored the release candidate don't need to change anything.

v0.1.0-rc.1 (release candidate)

Release candidate from the next integration branch, superseded by v0.1.0 (byte-identical vendored files).