PII and secret redactor

Detectors are patterns, not parsers. Cards must pass a Luhn checksum, SSNs must satisfy the SSA allocation rules, and IP octets must be in range, which cuts most false positives, but plain names and postal addresses are out of reach for pattern matching. The stable-token style is an honest trade: it derives from a hash of the value, so anyone holding a candidate value can confirm a match by hashing it. Phone numbers are off by default because their pattern over-matches; every match is listed above so you can judge before sharing.