ZapperSensitiveInfoDetector
ZapperSensitiveInfoDetector is a small web service that reads a file you point it to and reports the sensitive items inside it. Each finding comes with a type, position and confidence score, alongside a masked version of the text.
- Python
A Python API service that scans documents, spreadsheets, text and images for credentials, personal and financial data, and returns masked text.
- Python
- FastAPI
- Uvicorn
- Docker
- Microsoft Presidio
- Custom regular expression recognizers
- spaCy language model
- PyMuPDF for PDF
- python-docx
- openpyxl
- Tesseract OCR with Pillow
The challenge
Sensitive information hides in ordinary files. A spreadsheet export carries card numbers, a shared document includes a government ID, and a pasted configuration file holds an access key. Nobody planned to share these items, yet they travel with the file.
When those files are sent to partners, stored for later or passed to an AI model, the exposure grows with every copy. Teams need a repeatable way to check content first, and to mask what should not leave, rather than relying on people to spot it by eye.
What it does
Credential detection
Finds secrets such as cloud provider keys, API tokens for common developer and messaging services, database connection strings with credentials, and private keys, using custom pattern recognizers.
Personal and financial data
Detects items such as credit card numbers, bank account identifiers, government identification numbers, email addresses and phone numbers, using the Microsoft Presidio analysis engine.
Many file types
Separate endpoints handle CSV, XLSX, PDF, DOCX, plain text and image files. Images are read with Tesseract OCR before the text is analysed.
Findings with context
Each detected item is returned with its entity type, start and end position, confidence score and matched text, so reviewers can see what was found and where.
Masked text output
Responses include an anonymized version of the text in which detected items are replaced by their entity type labels, ready for review or onward use.
Editable detection patterns
Detection rules live in a JSON configuration file. Teams can add, adjust or switch off recognizers, and point the service at their own file with an environment variable.
How it works
Deploy the service
Build the included Docker image or run the FastAPI app directly. Set a separate API key for each file type endpoint through environment variables.
Send a file location
Call the endpoint for the file type with a Bearer token and a JSON body that holds the URL of the file to scan.
Analyse the content
The service downloads the file, extracts text, and runs the pattern recognizers and the language model based analysis over it to find sensitive items.
Review the response
Read the list of entities with types, positions and scores, plus the anonymized text. Use these to block, mask, route or flag the file.
Under the hood
- Language and framework
- Python
- FastAPI
- Uvicorn
- Docker
- Detection
- Microsoft Presidio
- Custom regular expression recognizers
- spaCy language model
- File handling
- PyMuPDF for PDF
- python-docx
- openpyxl
- Tesseract OCR with Pillow
- Interface
- REST endpoints
- JSON requests and responses
- Bearer token authentication
Inside the harness
Guardrails
Detected items can be masked before content reaches a model or a partner, giving guardrails concrete findings to act on rather than a general instruction.
Security
Credentials, keys and identifiers are found before they leave the boundary. The service uses a separate Bearer key per endpoint and should be deployed inside the customer's environment.
Data transfer
Files can be scanned before or after a transfer, so a workflow can hold, mask or route a file based on what the scan finds.
Audit
The service logs requests, processing progress and each detected entity type with its score, which gives a record of what was found. Review what is logged before use.
Business outcome
Sensitive data is seen before it moves. Teams learn what a file contains before it is shared, stored or sent to a model, which turns an assumption into a check.
One service for many file types. Documents, spreadsheets, text and images go through the same kind of call and return the same response shape, which keeps integrations simple.
Detection rules the team controls. Patterns sit in a readable configuration file, so security teams can add organisation-specific tokens and tune what counts as sensitive.
A reviewable starting point. The code is small and open under the MIT licence, so engineering and security teams can read it, test it and adapt it to local needs.
Where it is used
- Scanning files before they are sent to a partner, to catch card numbers or identification numbers.
- Checking documents and spreadsheets before they are given to an AI model as context.
- Searching shared text and configuration files for leaked keys, tokens and connection strings.
- Reviewing scanned images and PDFs for personal data before they are archived.
Frequently asked questions
How do I use it?
Clone the repository, copy the example environment file, set an API key for each endpoint, then build and run the Docker image. Post a JSON body with a source file URL to the endpoint for your file type.
What licence is it under?
The README states the MIT licence and the repository includes a LICENSE file with the MIT text. Confirm the terms with Zapper Edge if you plan to build a commercial product on it.
Does it use an AI model?
Detection combines custom pattern rules with Microsoft Presidio and a small spaCy language model. It does not call an external AI model service. Its findings can be used to control what reaches one.
Is it production-ready?
The README describes it that way, but treat it as a starting point to review. Test the patterns on your own data, check logging and file download behaviour, and complete your own security review before real use.
Using this in a governed AI setup?
Talk to us about running it inside the harness, with policy, guardrails and audit around it.