pgclone 4.4.4 — Auto-discover bank account numbers; remote masking_report

Feature release addressing issue #23.

Highlights

Auto-discover bank account numbers

pgclone.discover_sensitive() and pgclone.masking_report() now recognize bank account / IBAN columns — bank_account, bankaccount, account_number, accountnumber, acct_number, acctnumber, iban, and case variants — and suggest the null strategy, the same full-redaction treatment already used for SSN and credit card numbers. A bank account number identifies a specific person's account, not just a bank, so it gets the same conservative default.

SELECT pgclone.discover_sensitive('host=src dbname=app user=postgres', 'public');
-- {"customers": {"bank_account_number": "hash", "iban": "null", ...}}

(bank_account_number is steered to hash instead of null when the column is NOT NULL — the same existing steering already applied to SSN/credit card columns.)

Audit a remote source directly with masking_report

pgclone.masking_report() gains a 2-arg overload: masking_report(source_conninfo, schema_name). This is the "report of auto-discovered sensitive columns with no masking applied, and why" the issue asked for — masking_report() already produced exactly that (with a recommendation column explaining FK/type/constraint reasons a column was left unmasked), but only against a local, already-cloned schema. It can now run directly against a remote source, before anything is cloned, the same way discover_sensitive() already does:

SELECT * FROM pgclone.masking_report(
    'host=prod dbname=myapp user=postgres',
    'public'
) WHERE mask_status = 'UNMASKED';

Fixed

• pgclone.version() was accidentally left reporting 4.4.2 in the 4.4.3 release — the hardcoded version string is bumped by hand each release and was missed last time. Now correctly reports pgclone 4.4.4.

Compatibility

• No behavior change for existing callers beyond the new "Bank Account" category appearing when a matching column name exists — nothing previously suggested is changed or removed.
• sql/pgclone--4.4.3--4.4.4.sql only adds the new masking_report(TEXT, TEXT) overload; no existing function signature changes.
• Identical behavior on PostgreSQL 14–18.

Upgrade

ALTER EXTENSION pgclone UPDATE TO '4.4.4';

Or a fresh install: make install then CREATE EXTENSION pgclone;

Tests

pgTAP group 29 (7 new tests, plan 126 → 133) plus a customer_accounts fixture, covering discover_sensitive's bank-account detection (including NOT NULL → hash steering) and both the new remote and existing local masking_report overloads.

Full changelog: see CHANGELOG.md ([4.4.4]).